CVE-2015-0581
Cisco Prime Service Catalog < 10.0 - Authenticated XML External Entity Injection
Title source: llmDescription
The XML parser in Cisco Prime Service Catalog before 10.1 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, as demonstrated by reading private keys, related to an XML External Entity (XXE) issue, aka Bug ID CSCup92880.
References (3)
Core 3
Core References
Vendor Advisory vendor-advisory
x_refsource_cisco
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150128-psc-xmlee
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/72350
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1031658
Scores
EPSS
0.0237
EPSS Percentile
82.1%
Details
Status
published
Products (1)
cisco/prime_service_catalog
< 10.0
Published
Jan 28, 2015
Tracked Since
Feb 18, 2026