CVE-2013-1225

Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 allows remote attackers to read arbitrary files via a Resource Manager (1) HTTP or (2) HTTPS request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug ID CSCub38366.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.8 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:C/I:N/A:N
ciscoCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 67%
VendorProductVersion
ciscounified_customer_voice_portal
𝑥
≤ 9.0\(1\)
ciscounified_customer_voice_portal
3.0:sr1
ciscounified_customer_voice_portal
3.0:sr2
ciscounified_customer_voice_portal
3.6\(10\):es01
ciscounified_customer_voice_portal
4.0
ciscounified_customer_voice_portal
4.0\(2\)
ciscounified_customer_voice_portal
4.0\(2\):sr1
ciscounified_customer_voice_portal
4.1
ciscounified_customer_voice_portal
7.0
ciscounified_customer_voice_portal
7.0\(2\)
ciscounified_customer_voice_portal
8.0\(1\)
ciscounified_customer_voice_portal
8.5\(1\)
ciscounified_customer_voice_portal
9.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130508-cvp
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130508-cvp