CVE-2015-0754 — HIGH (7.5) — White Hats Nepal

Vulnerability Description

Cisco Finesse 10.5(1) allows remote authenticated users to obtain sensitive information or cause a denial of service (CPU and memory consumption) via a crafted XML document, aka Bug ID CSCut95810.

CVSS Score

7.5

HIGH

AV:N/AC:L/Au:S/C:P/I:N/A:C

Confidentiality

PARTIAL

Integrity

NONE

Availability

COMPLETE

Affected Products

Vendor	Product	Versions
Cisco	Finesse	10.5\(1\)_base

Related Weaknesses (CWE)

CWE-20

References

http://tools.cisco.com/security/center/viewAlert.x?alertId=39015Vendor Advisory
http://www.securitytracker.com/id/1032423Third Party AdvisoryVDB Entry
http://tools.cisco.com/security/center/viewAlert.x?alertId=39015Vendor Advisory
http://www.securitytracker.com/id/1032423Third Party AdvisoryVDB Entry

FAQ

What is CVE-2015-0754?

CVE-2015-0754 is a vulnerability with a CVSS score of 7.5 (HIGH). Cisco Finesse 10.5(1) allows remote authenticated users to obtain sensitive information or cause a denial of service (CPU and memory consumption) via a crafted XML document, aka Bug ID CSCut95810.

How severe is CVE-2015-0754?

CVE-2015-0754 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2015-0754?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Finesse.