CVE-2019-12711 Cisco Unified Communications Manager XML External Expansion Vulnerability

Medium 6.1 Published 2 Oct 2019 Updated 21 Nov 2024

Unauthenticated attackers can exploit XML entity restrictions to read local files or cause denial of service in Cisco Unified Communications Manager.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2019-12711?

CVE-2019-12711 is a medium-severity vulnerability in Cisco Unified Communications Manager, published on 2 Oct 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) condition. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit this vulnerability by sending malicious requests to an affected system that contain references in XML entities. A successful exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information, or cause the application to consume available resources, resulting in a DoS condition.

Weakness: CWE-611

Which versions are affected by CVE-2019-12711?

It affects 1 product.

Products include Cisco Unified Communications Manager.

How do I fix CVE-2019-12711?

No fix has been published for CVE-2019-12711 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-12711 being exploited?

There is no known exploitation of CVE-2019-12711 in the wild and no public exploit code.

All Cisco Unified Communications Manager vulnerabilities

Sources

Also known as GHSA-8973-52qv-v8p9.