CVE-2020-3256 Cisco Hosted Collaboration Mediation Fulfillment XML External Expansion Vulnerability

Medium 4.9 Published 6 May 2020 Updated 15 Nov 2024

An authenticated admin can exploit an XXE vulnerability in Cisco HCM-F to read sensitive files from the local system.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-3256?

CVE-2020-3256 is a medium-severity vulnerability in Cisco Hosted Collaboration Mediation Fulfillment, published on 6 May 2020. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A vulnerability in the web-based management interface of Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. To exploit this vulnerability, an attacker would need administrative privileges on the Cisco HCM-F Software. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by sending malicious requests that contain references in XML entities to an affected system. A successful exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information.

Weakness: CWE-611

Which versions are affected by CVE-2020-3256?

It affects 1 product.

Products include Cisco Hosted Collaboration Mediation Fulfillment.

How do I fix CVE-2020-3256?

No fix has been published for CVE-2020-3256 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-3256 being exploited?

There is no known exploitation of CVE-2020-3256 in the wild and no public exploit code.

Sources

Also known as GHSA-j23c-hpx8-w7p9.