Path Traversal in Cisco Ciscoworks Common Services
CVE-2009-1161
Directory traversal vulnerability in the TFTP service in Cisco CiscoWorks Common Services (CWCS) 3.0.x through 3.2.x on Windows, as used in Cisco Unified Service Monitor, Security Manager, TelePresence Readiness Assessment Manager, Unified Operations Manager, Unified Provisioning Manager, and other products, allows remote attackers to access arbitrary files via unspecified vectors.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.125 (96.0th percentile) — read the EPSS interpretation.
Affected products
- Cisco Ciscoworks_common_services — versions 3.0.3, 3.0.4, 3.0.5
- Cisco Ciscoworks_health_and_utilization_monitor — versions 1.0, 1.1
- Cisco Ciscoworks_lan_management_solution — versions 2.5, 2.6, 3.0
- Cisco Ciscoworks_qos_policy_manager — versions 4.0, 4.1
- Cisco Ciscoworks_voice_manager — versions 3.0, 3.1
- Cisco Security_manager — versions 3.0, 3.1, 3.2
- Cisco Telepresence_readiness_assessment_manager — versions 1.0
- Cisco Unified_operations_manager — versions 1.0, 1.1, 2.0
- Cisco Unified_provisioning_manager — versions 1.0, 1.1, 1.2
- Cisco Unified_service_monitor — versions 1.0, 1.1, 2.0
Weakness classification (CWE)
References
- psirt@cisco.com (x_refsource_JVNDB, third-party-advisory)
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Patch, Vendor Advisory)
- psirt@cisco.com (vdb-entry, x_refsource_BID)
- psirt@cisco.com (x_refsource_JVN, third-party-advisory)
- psirt@cisco.com (x_refsource_OSVDB, vdb-entry)
- psirt@cisco.com (vdb-entry, x_refsource_SECTRACK)
- psirt@cisco.com (vdb-entry, x_refsource_VUPEN)
- psirt@cisco.com (x_refsource_SECUNIA, third-party-advisory)