R. Freingruber

**Name of the Vulnerable Software and Affected Versions** Polycom RealPresence Resource Manager versions prior to 8.4 **Description** The issue allows local users to have an unspecified impact due to weak passwords. **Recommendations** For versions prior to 8.4, update to version 8.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Polycom RealPresence Resource Manager versions prior to 8.4 **Description** The issue allows remote authenticated users to obtain the installation path via an HTTP POST request to "PlcmRmWeb/JConfigManager". **Recommendations** For versions prior to 8.4, update to version 8.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Polycom RealPresence Resource Manager versions prior to 8.4 **Description** The issue allows attackers to obtain sensitive information and potentially gain privileges. This is achieved by leveraging the use of session identifiers as parameters with HTTP GET requests. **Recommendations** For versions prior to 8.4, update to version 8.4 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information and limiting privileges to minimize the risk of exploitation. Avoid using session identifiers as parameters in HTTP GET requests until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Polycom RealPresence Resource Manager versions prior to 8.4 **Description** The issue allows remote authenticated users to read arbitrary files and remote authenticated administrators to upload arbitrary files. This can be achieved through various parameters in different requests, including the `Modifier` parameter to `/PlcmRmWeb/FileDownload`, the `Filename` or `SE FNAME` parameter to `/PlcmRmWeb/FileUpload`, and the `filePathName` parameter in an importSipUriReservations SOAP request to `/PlcmRmWeb/JUserManager`. **Recommendations** For versions prior to 8.4, update to version 8.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `/PlcmRmWeb/FileDownload`, `/PlcmRmWeb/FileUpload`, and `/PlcmRmWeb/JUserManager` endpoints to minimize the risk of exploitation. Additionally, restrict the use of the `Modifier`, `Filename`, `SE FNAME`, and `filePathName` parameters in these endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Polycom RealPresence Resource Manager versions prior to 8.4 **Description** The issue allows local users with access to the plcm account to gain privileges due to a sudo misconfiguration. This is related to a script in /var/polycom/cma/upgrade/scripts. **Recommendations** For versions prior to 8.4, update to version 8.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the /var/polycom/cma/upgrade/scripts directory to minimize the risk of exploitation.