中文描述:

Cisco Prime Infrastructure（PI）和Cisco Evolved Programmable Network Manager（EPNM）都是美国思科（Cisco）公司的产品。PI是一套通过Cisco Prime LAN Management Solution（LMS）和Cisco Prime Network Control System（NCS）技术进行无线管理的解决方案；EPNM是一套网络管理解决方案。 Cisco PI和EPNM中的基于Web的用户界面存在XML外部实体注入漏洞，该漏洞源于程序没有正确的处理XML外部实体。远程攻击者可通过诱使管理员导入特制的XML文件利用该漏洞读取和写入文件，在应用程序中执行代码。以下产品和版本受到影响：Cisco Prime Infrastructure 1.1版本至3.1.6版本；Evolved Programmable Network Manager 1.2版本，2.0版本，2.1版本。

英文描述:

A vulnerability in the web-based user interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker read and write access to information stored in the affected system as well as perform remote code execution. The attacker must have valid user credentials. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file with malicious entries which could allow the attacker to read and write files and execute remote code within the application, aka XML Injection. Cisco Prime Infrastructure software releases 1.1 through 3.1.6 are vulnerable. Cisco EPNM software releases 1.2, 2.0, and 2.1 are vulnerable. Cisco Bug IDs: CSCvc23894 CSCvc49561.

CWE类型:

标签:

中文解决方案:

英文解决方案:

临时解决方案: