PT-2017-17297 · Cisco · Cisco Unified Communications Manager

Publicado 2017-08-07 · Atualizado 2019-10-09 · CVE-2017-6758

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager version 11.5(1.10000.6)

Description A vulnerability in the web framework could allow an authenticated, remote attacker to access arbitrary files in the context of the web root directory structure on an affected device. The issue is due to insufficient input validation by the affected software. An attacker could exploit this by using directory traversal techniques to read files in the web root directory structure on the Cisco Unified Communications Manager filesystem.

Recommendations For Cisco Unified Communications Manager version 11.5(1.10000.6), update to a fixed version to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2017-6758

Produtos afetados

Cisco Unified Communications Manager

Referências · 6

• http://securityfocus.com/bid/100119 · Nota
• https://osv.dev/vulnerability/CVE-2017-6758 · Aviso do Fabricante
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-ucm1 · Aviso do Fabricante
• http://securitytracker.com/id/1039064 · Nota
• https://quickview.cloudapps.cisco.com/quickview/bug/CSCve13796 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6758 · Nota de Segurança