CVE-2011-3287

2011-10-0610:55:00

CWE-399

[email protected]

web.nvd.nist.gov

cisco

jabber

xcp

cve-2011-3287

bug id csctq78106

denial of service

xml

security vulnerability

6.7 Medium

AI Score

Confidence

High

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.002 Low

EPSS

Percentile

52.9%

JSON

Cisco Jabber Extensible Communications Platform (aka Jabber XCP) 2.x through 5.4.x before 5.4.0.27581 and 5.8.x before 5.8.1.27561 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption, and process crash) via a crafted XML document containing a large number of nested entity references, aka Bug ID CSCtq78106, a similar issue to CVE-2003-1564.

CPENameOperatorVersion
cisco:jabber_extensible_communications_platformcisco jabber extensible communications platformle5.8
cisco:jabber_extensible_communications_platformcisco jabber extensible communications platformeq5.0
cisco:jabber_extensible_communications_platformcisco jabber extensible communications platformeq5.2
cisco:jabber_extensible_communications_platformcisco jabber extensible communications platformle5.4
cisco:jabber_extensible_communications_platformcisco jabber extensible communications platformeq5.1

CPE	Name	Operator	Version
cisco:jabber_extensible_communications_platform	cisco jabber extensible communications platform	le	5.8
cisco:jabber_extensible_communications_platform	cisco jabber extensible communications platform	eq	5.0
cisco:jabber_extensible_communications_platform	cisco jabber extensible communications platform	eq	5.2
cisco:jabber_extensible_communications_platform	cisco jabber extensible communications platform	le	5.4
cisco:jabber_extensible_communications_platform	cisco jabber extensible communications platform	eq	5.1