VAR-201501-0218

Vulnerability from variot - Updated: 2023-12-18 12:57

The XML parser in Cisco Prime Service Catalog before 10.1 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, as demonstrated by reading private keys, related to an XML External Entity (XXE) issue, aka Bug ID CSCup92880. (CPU And memory consumption ) There are vulnerabilities that are put into a state. This case XML External entity (XXE) Vulnerability related to the problem. Vendors have confirmed this vulnerability Bug ID CSCup92880 It is released as. Supplementary information : CWE Vulnerability type by CWE-611: Improper Restriction of XML External Entity Reference ('XXE') (XML Inappropriate restrictions on external entity references ) Has been identified. Attackers can exploit this issue to obtain potentially sensitive information or cause a denial-of-service condition. This may lead to further attacks. The solution supports automated ordering of a unified service catalog of computing, networking, storage, and other data center resources

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201501-0218",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "prime service catalog",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "10.0"
      },
      {
        "model": "prime service catalog",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "cisco",
        "version": "10.1"
      },
      {
        "model": "prime service catalog",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": "10.0"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-001264"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-0581"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201501-667"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_service_catalog:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "10.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2015-0581"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Alexios Dimitriadis and Cisco",
    "sources": [
      {
        "db": "BID",
        "id": "72350"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2015-0581",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.0,
            "impactScore": 7.8,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "Single",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 7.5,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "CVE-2015-0581",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.0,
            "id": "VHN-78527",
            "impactScore": 7.8,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:S/C:C/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2015-0581",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201501-667",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-78527",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-78527"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-001264"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-0581"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201501-667"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The XML parser in Cisco Prime Service Catalog before 10.1 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, as demonstrated by reading private keys, related to an XML External Entity (XXE) issue, aka Bug ID CSCup92880. (CPU And memory consumption ) There are vulnerabilities that are put into a state. This case XML External entity (XXE) Vulnerability related to the problem. Vendors have confirmed this vulnerability Bug ID CSCup92880 It is released as. Supplementary information : CWE Vulnerability type by CWE-611: Improper Restriction of XML External Entity Reference (\u0027XXE\u0027) (XML Inappropriate restrictions on external entity references ) Has been identified. \nAttackers can exploit this issue to obtain potentially sensitive information or cause a denial-of-service condition. This may lead to further attacks. The solution supports automated ordering of a unified service catalog of computing, networking, storage, and other data center resources",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2015-0581"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-001264"
      },
      {
        "db": "BID",
        "id": "72350"
      },
      {
        "db": "VULHUB",
        "id": "VHN-78527"
      }
    ],
    "trust": 1.98
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2015-0581",
        "trust": 2.8
      },
      {
        "db": "BID",
        "id": "72350",
        "trust": 1.4
      },
      {
        "db": "SECTRACK",
        "id": "1031658",
        "trust": 1.1
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-001264",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201501-667",
        "trust": 0.7
      },
      {
        "db": "CISCO",
        "id": "20150128 CISCO PRIME SERVICE CATALOG XML EXTERNAL ENTITY PROCESSING VULNERABILITY",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-78527",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-78527"
      },
      {
        "db": "BID",
        "id": "72350"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-001264"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-0581"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201501-667"
      }
    ]
  },
  "id": "VAR-201501-0218",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-78527"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T12:57:49.966000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "cisco-sa-20150128-psc-xmlee",
        "trust": 0.8,
        "url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20150128-psc-xmlee"
      },
      {
        "title": "4971/0",
        "trust": 0.8,
        "url": "http://tools.cisco.com/security/center/viewipssignature.x?signatureid=4971\u0026signaturesubid=0\u0026softwareversion=6.0\u0026releaseversion=s847"
      },
      {
        "title": "4971/1",
        "trust": 0.8,
        "url": "http://tools.cisco.com/security/center/viewipssignature.x?signatureid=4971\u0026signaturesubid=1\u0026softwareversion=6.0\u0026releaseversion=s847"
      },
      {
        "title": "37136",
        "trust": 0.8,
        "url": "http://tools.cisco.com/security/center/viewalert.x?alertid=37136"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-001264"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-Other",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-001264"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-0581"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20150128-psc-xmlee"
      },
      {
        "trust": 1.1,
        "url": "http://www.securityfocus.com/bid/72350"
      },
      {
        "trust": 1.1,
        "url": "http://www.securitytracker.com/id/1031658"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-0581"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-0581"
      },
      {
        "trust": 0.3,
        "url": "http://www.cisco.com/"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-78527"
      },
      {
        "db": "BID",
        "id": "72350"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-001264"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-0581"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201501-667"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-78527"
      },
      {
        "db": "BID",
        "id": "72350"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-001264"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-0581"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201501-667"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2015-01-28T00:00:00",
        "db": "VULHUB",
        "id": "VHN-78527"
      },
      {
        "date": "2015-01-29T00:00:00",
        "db": "BID",
        "id": "72350"
      },
      {
        "date": "2015-01-30T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-001264"
      },
      {
        "date": "2015-01-28T22:59:02.937000",
        "db": "NVD",
        "id": "CVE-2015-0581"
      },
      {
        "date": "2015-01-29T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201501-667"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2015-09-17T00:00:00",
        "db": "VULHUB",
        "id": "VHN-78527"
      },
      {
        "date": "2015-01-29T00:00:00",
        "db": "BID",
        "id": "72350"
      },
      {
        "date": "2015-01-30T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-001264"
      },
      {
        "date": "2015-09-17T16:32:49.990000",
        "db": "NVD",
        "id": "CVE-2015-0581"
      },
      {
        "date": "2015-01-29T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201501-667"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201501-667"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cisco Prime Service Catalog of  XML Vulnerability in parser to read arbitrary files",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-001264"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Design Error",
    "sources": [
      {
        "db": "BID",
        "id": "72350"
      }
    ],
    "trust": 0.3
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.