CVE-2017-6758: Path Traversal
First published: Mon Aug 07 2017(Updated: )
A vulnerability in the web framework of Cisco Unified Communications Manager 11.5(1.10000.6) could allow an authenticated, remote attacker to access arbitrary files in the context of the web root directory structure on an affected device. The vulnerability is due to insufficient input validation by the affected software. An attacker could exploit this vulnerability by using directory traversal techniques to read files in the web root directory structure on the Cisco Unified Communications Manager filesystem. Cisco Bug IDs: CSCve13796.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unified Communications Manager | =11.5\(1.10000.6\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-6758?
CVE-2017-6758 has been assigned a high severity rating due to the potential for authenticated remote attackers to access sensitive files.
How do I fix CVE-2017-6758?
To fix CVE-2017-6758, it is recommended to upgrade Cisco Unified Communications Manager to a version where this vulnerability is addressed.
What is the impact of CVE-2017-6758 on Cisco Unified Communications Manager?
The impact of CVE-2017-6758 allows attackers to retrieve arbitrary files from the web root directory, which could expose sensitive information.
Can unprivileged users exploit CVE-2017-6758?
No, CVE-2017-6758 requires an attacker to be authenticated to exploit the vulnerability.
What versions of Cisco Unified Communications Manager are affected by CVE-2017-6758?
CVE-2017-6758 specifically affects Cisco Unified Communications Manager version 11.5(1.10000.6).
- agent/references
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/tags
- agent/source
- vendor/cisco
- canonical/cisco unified communications manager
- version/cisco unified communications manager/11.5\(1.10000.6\)