« Volver al listado

CVE-2011-3287

Estado: ModificadaAlta (7.8)—

Cisco Jabber Extensible Communications Platform (aka Jabber XCP) 2.x through 5.4.x before 5.4.0.27581 and 5.8.x before 5.8.1.27561 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption, and process crash) via a crafted XML document containing a large number of nested entity references, aka Bug ID CSCtq78106, a similar issue to CVE-2003-1564.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cisco — Jabber Extensible Communications Platform

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2011-3287",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2011-10-06T10:55:05.050",
  "references": [
    {
      "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d47.shtml",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d47.shtml",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-399"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cisco Jabber Extensible Communications Platform (aka Jabber XCP) 2.x through 5.4.x before 5.4.0.27581 and 5.8.x before 5.8.1.27561 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption, and process crash) via a crafted XML document containing a large number of nested entity references, aka Bug ID CSCtq78106, a similar issue to CVE-2003-1564."
    },
    {
      "lang": "es",
      "value": "Cisco Jabber Extensible Communications Platform (también conocido como Jabber XCP) v2.x hasta la v5.4.x antes de v5.4.0.27581 y v5.8.x antes de v5.8.1.27561 no detecta correctamente la recursividad durante la expansión de la entidad, lo que permite a atacantes remotos provocar una denegación de servicio (consumo de memoria y CPU, y finalmente la caída del proceso) a través de un documento XML debidamente modificado que contiene un gran número de referencias a entidades anidadas. Se trata de un problema también conocido como Bug ID CSCtq78106. Es un problema similar a CVE-2003-1564."
    }
  ],
  "lastModified": "2026-06-16T23:33:01.947",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:jabber_extensible_communications_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FD4081C-693D-428E-BAA3-CD84FA32CAA9",
              "versionEndIncluding": "5.8"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:jabber_extensible_communications_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D89D6B4A-5A22-4B72-ADAA-60BDC278BCE8",
              "versionEndIncluding": "5.4"
            },
            {
              "criteria": "cpe:2.3:a:cisco:jabber_extensible_communications_platform:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7E2AB986-DA30-4DA7-8894-14D9579E7734"
            },
            {
              "criteria": "cpe:2.3:a:cisco:jabber_extensible_communications_platform:5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C0E07317-7E24-4455-9BBC-CF0C9B3F17FB"
            },
            {
              "criteria": "cpe:2.3:a:cisco:jabber_extensible_communications_platform:5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7967087-068F-4AC9-A7D5-7A493202D718"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}