cisco-sa-cucm-path-trav-dKCvktvO: Cisco Unified Communications Products Path Traversal Vulnerability
First published: Wed Nov 03 2021(Updated: )
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), and Cisco Unity Connection could allow an authenticated, remote attacker to access sensitive data on an affected device. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to access sensitive files on the affected system. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-path-trav-dKCvktvO
Credit: This vulnerability was found during the resolution a Cisco TAC support case
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Products | =Cisco Unity Connection<14SU1=Cisco Unified CM IM&P<14SU1=Cisco Unified CM SME<14SU1=Cisco Unified CM<14SU1 | 14SU1 14SU1 14SU1 14SU1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-cucm-path-trav-dKCvktvO?
The severity of cisco-sa-cucm-path-trav-dKCvktvO is classified as high.
How do I fix cisco-sa-cucm-path-trav-dKCvktvO?
To fix cisco-sa-cucm-path-trav-dKCvktvO, upgrade to the latest version indicated in the advisory provided by Cisco.
What products are affected by cisco-sa-cucm-path-trav-dKCvktvO?
The affected products include Cisco Unified Communications Manager, Cisco Unified CM IM&P, Cisco Unified CM SME, and Cisco Unity Connection.
What type of vulnerability is cisco-sa-cucm-path-trav-dKCvktvO?
cisco-sa-cucm-path-trav-dKCvktvO is a path traversal vulnerability in the web-based management interface.
Is a workaround available for cisco-sa-cucm-path-trav-dKCvktvO?
There are no specific workarounds available for cisco-sa-cucm-path-trav-dKCvktvO, and updating to the fixed release is recommended.
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/title
- agent/references
- agent/weakness
- agent/author
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/cisco-advisory
- source/Cisco
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco products
- version/cisco products/cisco unity connection
- version/cisco products/cisco unified cm im&p
- version/cisco products/cisco unified cm sme
- version/cisco products/cisco unified cm