CVE-2015-4315 - The Call Policy Configuration page in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.3 improperly validates external DTDs, which allows remote authenticated users to read arbitrary files or cause a denial of service via a crafted XML document, aka Bug ID CSCuv31853

Back Back to CVE browser

MEDIUM

The Call Policy Configuration page in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.3 improperly validates external DTDs, which allows remote authenticated users to read arbitrary files or cause a denial of service via a crafted XML document, aka Bug ID CSCuv31853

Published Aug 20, 2015

5.5

MEDIUM

CVSS 2.0

EPSS 1.87%

Description

The Call Policy Configuration page in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.3 improperly validates external DTDs, which allows remote authenticated users to read arbitrary files or cause a denial of service via a crafted XML document, aka Bug ID CSCuv31853.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (3)

http://tools.cisco.com/security/center/viewAlert.x?alertId=40446
vendor-advisoryx_refsource_CISCOVendor Advisory
http://www.securityfocus.com/bid/76352
vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1033283
vdb-entryx_refsource_SECTRACK

Link	Providers	Tags
http://tools.cisco.com/security/center/viewAlert.x?alertId=40446		vendor-advisoryx_refsource_CISCOVendor Advisory
http://www.securityfocus.com/bid/76352		vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1033283		vdb-entryx_refsource_SECTRACK

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner cisco

Published Aug 20, 2015

Updated Aug 6, 2024

Reserved Jun 4, 2015

Link CVE-2015-4315

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2015-4315

Red Hat

Severity n/a

Public date n/a

Links CVE-2015-4315