CVE-2016-1358 XML external entity in n/a

What is CVE-2016-1358?

CVE-2016-1358 is a medium-severity vulnerability in Cisco Prime Infrastructure, published on 3 Mar 2016. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Cisco Prime Infrastructure 2.2, 3.0, and 3.1(0.0) allows remote authenticated users to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug ID CSCuw81497.

Weakness: CWE-119

Which versions are affected by CVE-2016-1358?

It affects 1 product.

Products include Cisco Prime Infrastructure.

How do I fix CVE-2016-1358?

No fix has been published for CVE-2016-1358 yet. Limit exposure of the affected software until one is available.

Is CVE-2016-1358 being exploited?

There is no known exploitation of CVE-2016-1358 in the wild and no public exploit code.

Other vulnerabilities in Cisco Prime Infrastructure

• CVE-2018-15379 Cisco Prime Infrastructure Arbitrary File Upload and Command Execution Vulnerability Critical 9.8
• CVE-2014-0679 Command injection in n/a Critical 9.0
• CVE-2016-1442 Command injection in n/a High 8.8
• CVE-2016-1359 Code injection in n/a High 8.8
• CVE-2019-1659 Cisco Prime Infrastructure Certificate Validation Vulnerability High 7.4

All Cisco Prime Infrastructure vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w8jj-j97r-vm8v.