CVE-2015-0581 XML external entity in n/a
Remote authenticated users can read arbitrary files or cause denial of service via XML External Entity injection in Cisco Prime Service Catalog.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-0581?
CVE-2015-0581 is a high-severity vulnerability in n/a, published on 28 Jan 2015. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The XML parser in Cisco Prime Service Catalog before 10.1 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, as demonstrated by reading private keys, related to an XML External Entity (XXE) issue, aka Bug ID CSCup92880.
Which versions are affected by CVE-2015-0581?
It affects 1 product.
Products include Cisco Prime Service Catalog.
How do I fix CVE-2015-0581?
No fix has been published for CVE-2015-0581 yet. Limit exposure of the affected software until one is available.
Is CVE-2015-0581 being exploited?
There is no known exploitation of CVE-2015-0581 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2019-1874 Cisco Prime Service Catalog Cross-Site Request Forgery Vulnerability
- CVE-2018-0107 Cross-site request forgery in Cisco Prime Service Catalog
- CVE-2018-0285 Denial of service in Cisco Prime Service Catalog
- CVE-2017-12364 SQL injection in Cisco Prime Service Catalog
- CVE-2015-6395 Missing authorization in n/a
Sources
Also known as GHSA-34hv-w8p5-75g4.