PT-2017-17297 · Cisco · Cisco Unified Communications Manager

Published 2017-08-07 · Updated 2019-10-09 · CVE-2017-6758

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager version 11.5(1.10000.6)

Description A vulnerability in the web framework could allow an authenticated, remote attacker to access arbitrary files in the context of the web root directory structure on an affected device. The issue is due to insufficient input validation by the affected software. An attacker could exploit this by using directory traversal techniques to read files in the web root directory structure on the Cisco Unified Communications Manager filesystem.

Recommendations For Cisco Unified Communications Manager version 11.5(1.10000.6), update to a fixed version to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-6758

Affected Products

Cisco Unified Communications Manager

References · 6

• https://osv.dev/vulnerability/CVE-2017-6758 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-ucm1 · Vendor Advisory
• https://quickview.cloudapps.cisco.com/quickview/bug/CSCve13796 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6758 · Security Note
• http://securityfocus.com/bid/100119 · Note
• http://securitytracker.com/id/1039064 · Note