PT-2017-6787 · Polycom · Polycom Realpresence Resource Manager

C.A + 1 · Published 2017-09-19 · Updated 2018-10-09 · CVE-2015-4684

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Polycom RealPresence Resource Manager versions prior to 8.4

Description The issue allows remote authenticated users to read arbitrary files and remote authenticated administrators to upload arbitrary files. This can be achieved through various parameters in different requests, including the Modifier parameter to /PlcmRmWeb/FileDownload, the Filename or SE FNAME parameter to /PlcmRmWeb/FileUpload, and the filePathName parameter in an importSipUriReservations SOAP request to /PlcmRmWeb/JUserManager.

Recommendations For versions prior to 8.4, update to version 8.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the /PlcmRmWeb/FileDownload, /PlcmRmWeb/FileUpload, and /PlcmRmWeb/JUserManager endpoints to minimize the risk of exploitation. Additionally, restrict the use of the Modifier, Filename, SE FNAME, and filePathName parameters in these endpoints until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2015-4684

Affected Products

Polycom Realpresence Resource Manager

References · 7

• 🔥 https://exploit-db.com/exploits/37449 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Jun/81 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-4684 · Security Note
• https://support.polycom.com/global/documents/support/documentation/Security_Center_Post_for_RPRM_CVEs.pdf · Vendor Advisory
• http://packetstormsecurity.com/files/132463/Polycom-RealPresence-Resource-Manager-RPRM-Disclosure-Traversal.html · Note
• http://securityfocus.com/bid/75432 · Note
• http://securityfocus.com/archive/1/535852/100/0/threaded · Note