Sign-up

ID

VAR-201910-0347


CVE

CVE-2019-12711


TITLE

Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition In XML External entity vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2019-010337

DESCRIPTION

A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) condition. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit this vulnerability by sending malicious requests to an affected system that contain references in XML entities. A successful exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information, or cause the application to consume available resources, resulting in a DoS condition

Trust: 1.71

sources: NVD: CVE-2019-12711 // JVNDB: JVNDB-2019-010337 // VULHUB: VHN-144485

AFFECTED PRODUCTS

vendor:ciscomodel:unified communications managerscope:eqversion:12.0\(1.10000.10\)

Trust: 1.0

vendor:ciscomodel:unified communications managerscope:eqversion:10.5\(2.10000.5\)

Trust: 1.0

vendor:ciscomodel:unified communications managerscope:eqversion:11.5\(1.10000.6\)

Trust: 1.0

vendor:ciscomodel:unified communications managerscope:eqversion:12.5\(1.10000.22\)

Trust: 1.0

vendor:ciscomodel:unified communications managerscope: - version: -

Trust: 0.8

vendor:ciscomodel:unified communications managerscope:eqversion:10.52.10000.5

Trust: 0.6

vendor:ciscomodel:unified communications managerscope:eqversion:11.51.10000.6

Trust: 0.6

vendor:ciscomodel:unified communications managerscope:eqversion:12.01.10000.10

Trust: 0.6

vendor:ciscomodel:unified communications managerscope:eqversion:12.51.10000.22

Trust: 0.6

sources: JVNDB: JVNDB-2019-010337 // CNNVD: CNNVD-201910-075 // NVD: CVE-2019-12711

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-12711
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2019-12711
value: MEDIUM

Trust: 1.0

NVD: CVE-2019-12711
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201910-075
value: MEDIUM

Trust: 0.6

VULHUB: VHN-144485
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-12711
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-144485
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-12711
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
exploitabilityScore: 3.9
impactScore: 2.5
version: 3.1

Trust: 1.0

ykramarz@cisco.com: CVE-2019-12711
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
exploitabilityScore: 2.8
impactScore: 2.7
version: 3.0

Trust: 1.0

NVD: CVE-2019-12711
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-144485 // JVNDB: JVNDB-2019-010337 // CNNVD: CNNVD-201910-075 // NVD: CVE-2019-12711 // NVD: CVE-2019-12711

PROBLEMTYPE DATA

problemtype:CWE-611

Trust: 1.9

sources: VULHUB: VHN-144485 // JVNDB: JVNDB-2019-010337 // NVD: CVE-2019-12711

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201910-075

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-201910-075

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-010337

PATCH
title:cisco-sa-20191002-cucm-xxeurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-cucm-xxe
Trust: 0.8
title:Cisco Unified Communications Manager  and Cisco Unified Communications Manager Session Management Edition Fixes for code issue vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=98811
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-010337 // 
            
            
            
            CNNVD: CNNVD-201910-075

EXTERNAL IDS
db:NVDid:CVE-2019-12711
Trust: 2.5
db:JVNDBid:JVNDB-2019-010337
Trust: 0.8
db:CNNVDid:CNNVD-201910-075
Trust: 0.7
db:AUSCERTid:ESB-2019.3700
Trust: 0.6
db:AUSCERTid:ESB-2019.3700.2
Trust: 0.6
db:VULHUBid:VHN-144485
Trust: 0.1
sources:
            
            
            VULHUB: VHN-144485 // 
            
            
            
            JVNDB: JVNDB-2019-010337 // 
            
            
            
            CNNVD: CNNVD-201910-075 // 
            
            
            
            NVD: CVE-2019-12711

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20191002-cucm-xxe
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2019-12711
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-12711
Trust: 0.8
url:https://vigilance.fr/vulnerability/cisco-unified-communications-manager-external-xml-entity-injection-30517
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.3700/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.3700.2/
Trust: 0.6
sources:
            
            
            VULHUB: VHN-144485 // 
            
            
            
            JVNDB: JVNDB-2019-010337 // 
            
            
            
            CNNVD: CNNVD-201910-075 // 
            
            
            
            NVD: CVE-2019-12711

SOURCES
db:VULHUBid:VHN-144485
db:JVNDBid:JVNDB-2019-010337
db:CNNVDid:CNNVD-201910-075
db:NVDid:CVE-2019-12711

LAST UPDATE DATE
2024-08-14T13:25:38.247000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-144485date:2019-10-09T00:00:00
db:JVNDBid:JVNDB-2019-010337date:2019-10-11T00:00:00
db:CNNVDid:CNNVD-201910-075date:2019-10-25T00:00:00
db:NVDid:CVE-2019-12711date:2019-10-09T23:46:09.590

SOURCES RELEASE DATE
db:VULHUBid:VHN-144485date:2019-10-02T00:00:00
db:JVNDBid:JVNDB-2019-010337date:2019-10-11T00:00:00
db:CNNVDid:CNNVD-201910-075date:2019-10-02T00:00:00
db:NVDid:CVE-2019-12711date:2019-10-02T19:15:14.187