PT-2011-3251 · Cisco · Cisco Unified Communications Manager

Publicado 2011-05-03 · Atualizado 2017-08-17 · CVE-2011-1607

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions 6.x through 6.1(5)su2 Cisco Unified Communications Manager versions 7.x through 7.1(5b)su2 Cisco Unified Communications Manager versions 8.0 through 8.0(3a)su0 Cisco Unified Communications Manager versions 8.5 through 8.5(0)

Description The issue allows remote authenticated users to upload files to arbitrary directories via a modified pathname in an upload request.

Recommendations For versions 6.x through 6.1(5)su2, update to version 6.1(5)su3 or later. For versions 7.x through 7.1(5b)su2, update to version 7.1(5b)su3 or later. For versions 8.0 through 8.0(3a)su0, update to version 8.0(3a)su1 or later. For versions 8.5 through 8.5(0), update to version 8.5(1) or later.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2011-1607

Produtos afetados

Cisco Unified Communications Manager

Referências · 8

• http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0051.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67127 · Nota
• http://securityfocus.com/bid/47608 · Nota
• http://secunia.com/advisories/44331 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1607 · Nota de Segurança
• http://cisco.com/en/US/products/products_security_advisory09186a0080b79904.shtml · Aviso do Fabricante
• http://vupen.com/english/advisories/2011/1122 · Nota
• http://securitytracker.com/id?1025449 · Nota