Cisco Energy Management Suite XML External Entity Vulnerability
CVE-2018-15444

6.3MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Energy Management Suite
Vendor
CVE Published:
8 November 2018

Badges

👾 Exploit Exists

What is CVE-2018-15444?

A vulnerability in the web-based user interface of Cisco Energy Management Suite Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by convincing a user of an affected system to import a crafted XML file with malicious entries, which could allow the attacker to read and write files within the affected application.

Affected Version(s)

Cisco Energy Management Suite

References

https://tools.cisco.com/security/center/content/CiscoSecu...
vendor-advisoryx_refsource_CISCO
https://www.tenable.com/security/research/tra-2018-36
x_refsource_MISC
http://www.securityfocus.com/bid/105860
vdb-entryx_refsource_BID

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.