CVE-2015-4315
published 2015-08-20CVE-2015-4315: The Call Policy Configuration page in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.3 improperly validates external DTDs, which allows…
PriorityP427medium5.5CVSS 2.0
AVNACLAuSCPINAP
EPSS
1.87%
76.9th percentile
The Call Policy Configuration page in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.3 improperly validates external DTDs, which allows remote authenticated users to read arbitrary files or cause a denial of service via a crafted XML document, aka Bug ID CSCuv31853.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | telepresence_video_communication_server_software | — | — |
CVSS provenance
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:P
vendor_cisco5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Telepresence Video Communication Server Expressway Call Policy Configuration Page Denial of Service Vulnerability
vendor_cisco·2015-08-13·CVSS 5.5
CVE-2015-4315 [MEDIUM] CWE-20 Cisco Telepresence Video Communication Server Expressway Call Policy Configuration Page Denial of Service Vulnerability
Cisco Telepresence Video Communication Server Expressway Call Policy Configuration Page Denial of Service Vulnerability
A vulnerability in the Call Policy Configuration page of the Cisco TelePresence Video Communication Server (VCS) Expressway could allow an authenticated, remote attacker to cause a denial of service (DoS) condition or read arbitrary files on an affected system.
The vulnerability is due to insufficient validation of declared document type definitions (DTD) stored externally. An attacker could exploit this vulnerability by supplying a specially crafted XML file to the targeted system. An exploit could allow the attacker to launch a denial of service attack or read arbitrary files.
Cisco has confirmed the vulnerability; however, software updates are not available.
To ex
GHSA
GHSA-3ww7-qxrg-gc3h: The Call Policy Configuration page in Cisco TelePresence Video Communication Server (VCS) Expressway X8
ghsa_unreviewed·2022-05-17
CVE-2015-4315 [MEDIUM] CWE-20 GHSA-3ww7-qxrg-gc3h: The Call Policy Configuration page in Cisco TelePresence Video Communication Server (VCS) Expressway X8
The Call Policy Configuration page in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.3 improperly validates external DTDs, which allows remote authenticated users to read arbitrary files or cause a denial of service via a crafted XML document, aka Bug ID CSCuv31853.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2015-08-20
Published