XML injection in Cisco Prime Infrastructure - CVE-2017-6662
Published: June 22, 2017 / Updated: June 27, 2017
Vulnerability identifier: #VU7164
CSH Severity: Medium
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N]
CVE-ID: CVE-2017-6662
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to gain read and write access to information and possibly execute arbitrary code.
The vulnerability exists in the web based user interface due to improper handling of XML External Entity (XXE) entries when parsing an XML file. A remote attacker can trick the administrator of an affected system into importing a specially crafted XML file with malicious entries, read and write files and execute remote code within the application.
Successful exploitation of the vulnerability may allow an attacker to gain complete control over affected website.
Affected software
Cisco Prime Infrastructure
Evolved Programmable Network (EPN) Manager
Evolved Programmable Network (EPN) Manager
How to mitigate CVE-2017-6662
Install update from vendor's website.