Path Traversal in Cisco Unified Ccx
CVE-2011-3315
Directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x before 7.1(5b)SU2, and 8.x before 8.0(3), and Cisco Unified Contact Center Express (aka Unified CCX or UCCX) and Cisco Unified IP Interactive Voice Response (Unified IP-IVR) before 6.0(1)SR1ES8, 7.0(x) before 7.0(2)ES1, 8.0(x) through 8.0(2)SU3, and 8.5(x) before 8.5(1)SU2, allows remote attackers to read arbitrary files via a crafted URL, aka Bug IDs CSCth09343 and CSCts44049.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.264 (97.9th percentile) — read the EPSS interpretation.
Affected products
- Cisco Unified_ccx — versions 6.0\(1\), 7.0\(1\), 7.0\(2\)
- Cisco Unified_communications_manager — versions 6.1(3a), 6.1\(3b\)su1, 7.1\(2b\)
- Cisco Unified_ip_interactive_voice_response
- Cisco Unified_ip_ivr — versions 7.0\(1\), 8.5\(1\), 8.0(2)
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2011-3315?
- CVE-2011-3315 is a vulnerability in Cisco Unified Ccx, classified under Path Traversal. Published 2011-10-27.
- Is CVE-2011-3315 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.