CVE-2015-0620: Input Validation
Published Feb 18, 2015
·Updated
The XML parser in Cisco TelePresence Management Suite (TMS) 14.3(.2) and earlier does not properly handle external entities, which allows remote authenticated users to cause a denial of service via POST requests, aka Bug ID CSCus51494.
Affected Software
3 affected components
cisco TelePresence Management Suite<=14.3\(.2\)
cisco TelePresence Management Suite=14.3
cisco TelePresence Management Suite=14.3\(.1\)
Event History
Feb 18, 2015
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-0620?
CVE-2015-0620 has a severity rating of Medium, as it allows denial of service for authenticated users.
2
How do I fix CVE-2015-0620?
To remediate CVE-2015-0620, upgrade to Cisco TelePresence Management Suite version 14.3(3) or later.
3
What causes the vulnerability in CVE-2015-0620?
CVE-2015-0620 is caused by improper handling of external entities in the XML parser.
4
Who is affected by CVE-2015-0620?
CVE-2015-0620 affects users of Cisco TelePresence Management Suite versions 14.3(.2) and earlier.
5
Can CVE-2015-0620 be exploited remotely?
Yes, remote authenticated users can exploit CVE-2015-0620 through specially crafted POST requests.