PT-2017-17198 · Cisco · Cisco Unity Connection

Publicado 2017-05-03 · Atualizado 2017-07-11 · CVE-2017-6629

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unity Connection version 10.5(2)

Description A vulnerability could allow an unauthenticated, remote attacker to access files in arbitrary locations on the filesystem of an affected device. The issue is due to improper sanitization of user-supplied input in HTTP POST parameters that describe filenames, specifically the ImageID parameter. An attacker could exploit this by using directory traversal techniques to submit a path to a desired file location.

Recommendations For Cisco Unity Connection version 10.5(2), consider restricting access to the ImageID parameter in HTTP POST requests until a patch is available. As a temporary workaround, avoid using the ImageID parameter to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2017-6629

Produtos afetados

Cisco Unity Connection

Referências · 5

• http://securitytracker.com/id/1038400 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-6629 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-cuc · Aviso do Fabricante
• http://securityfocus.com/bid/98286 · Nota
• https://osv.dev/vulnerability/CVE-2017-6629 · Aviso do Fabricante