Cisco Hosted Collaboration Mediation Fulfillment Web-based Management Interface xml external entity reference

Summaryinfo

A vulnerability marked as problematic has been reported in Cisco Hosted Collaboration Mediation Fulfillment. The affected element is an unknown function of the component Web-based Management Interface. Performing a manipulation results in xml external entity reference. This vulnerability is cataloged as CVE-2020-3256. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Cisco Hosted Collaboration Mediation Fulfillment (Groupware Software) (the affected version is unknown). This affects an unknown code of the component Web-based Management Interface. The manipulation with an unknown input leads to a xml external entity reference vulnerability. CWE is classifying the issue as CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. This is going to have an impact on confidentiality. The summary by CVE is:

A vulnerability in the web-based management interface of Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. To exploit this vulnerability, an attacker would need administrative privileges on the Cisco HCM-F Software. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by sending malicious requests that contain references in XML entities to an affected system. A successful exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information.

The weakness was shared 05/06/2020 as cisco-sa-hcmf-xxe-qqCMAUJ2 as confirmed advisory (Website). The advisory is shared at tools.cisco.com. This vulnerability is uniquely identified as CVE-2020-3256 since 12/12/2019. It is possible to initiate the attack remotely. A authentication is needed for exploitation. Neither technical details nor an exploit are publicly available.

Upgrading eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Groupware Software

Vendor

• Cisco

Name

• Hosted Collaboration Mediation Fulfillment

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion