10.0crit
CVE-2016-1343
The XML parser in Cisco Information Server (CIS) 6.2 allows remote attackers to read arbitrary files or cause a denial of service (CPU and…
Published 10 y ago · modified 4 mo ago · JSON
CVSS
10.0
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.6%
percentile 76%
Public exploits
0
none known
Summary
The XML parser in Cisco Information Server (CIS) 6.2 allows remote attackers to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug ID CSCuy39059.
Exploit prediction (EPSS)
1.57% probability of exploitation in the next 30 days, higher than 76% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 10.0 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H |
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:P/I:N/A:P |
References
- tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20160428-cis · vendor-advisory, x_refsource_CISCO, x_transferred
Sources
- CVE List: CVE-2016-1343
- NVD: CVE-2016-1343
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.