PT-2011-3251 · Cisco · Cisco Unified Communications Manager

Published 2011-05-03 · Updated 2017-08-17 · CVE-2011-1607

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions 6.x through 6.1(5)su2 Cisco Unified Communications Manager versions 7.x through 7.1(5b)su2 Cisco Unified Communications Manager versions 8.0 through 8.0(3a)su0 Cisco Unified Communications Manager versions 8.5 through 8.5(0)

Description The issue allows remote authenticated users to upload files to arbitrary directories via a modified pathname in an upload request.

Recommendations For versions 6.x through 6.1(5)su2, update to version 6.1(5)su3 or later. For versions 7.x through 7.1(5b)su2, update to version 7.1(5b)su3 or later. For versions 8.0 through 8.0(3a)su0, update to version 8.0(3a)su1 or later. For versions 8.5 through 8.5(0), update to version 8.5(1) or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2011-1607

Affected Products

Cisco Unified Communications Manager

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2011-1607 · Security Note
• http://cisco.com/en/US/products/products_security_advisory09186a0080b79904.shtml · Vendor Advisory
• http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0051.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67127 · Note
• http://securityfocus.com/bid/47608 · Note
• http://secunia.com/advisories/44331 · Note
• http://vupen.com/english/advisories/2011/1122 · Note
• http://securitytracker.com/id?1025449 · Note