Lucene search

CiscoCVE-2017-6629

HistoryMay 03, 2017 - 9:59 p.m.

CVE-2017-6629

2017-05-0321:59:00

CWE-22

cisco

web.nvd.nist.gov

cve-2017-6629

cisco unity connection

remote attacker

file access

cisco bug id

nvd

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.002

Percentile

57.4%

JSON

A vulnerability in the ImageID parameter of Cisco Unity Connection 10.5(2) could allow an unauthenticated, remote attacker to access files in arbitrary locations on the filesystem of an affected device. The issue is due to improper sanitization of user-supplied input in HTTP POST parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. Cisco Bug IDs: CSCvd90118.

Affected configurations

Nvd

Node

ciscounity_connectionMatch10.5\(2\)

VendorProductVersionCPE
ciscounity_connection10.5(2)cpe:2.3:a:cisco:unity_connection:10.5\(2\):*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	unity_connection	10.5(2)	cpe:2.3:a:cisco:unity_connection:10.5\(2\):::::::*

CNA Affected

[
  {
    "product": "Cisco Unity Connection",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Unity Connection"
      }
    ]
  }
]

References

www.securityfocus.com/bid/98286

www.securitytracker.com/id/1038400

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-cuc

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.002

Percentile

57.4%

JSON

Related for CVE-2017-6629