Information disclosure in Cisco Unified_callmanager

CVE-2015-0680

Cisco Unified Call Manager (CM) 9.1(2.1000.28) does not properly restrict resource requests, which allows remote authenticated users to read arbitrary files via unspecified vectors, aka Bug ID CSCuq44439.

Vulnerability class: Information Disclosure

EPSS: 0.013 (67.9th percentile) — read the EPSS interpretation.

Affected products

Cisco Unified_callmanager — versions 9.1\(2.1000.28\)
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
psirt@cisco.com (vdb-entry, x_refsource_SECTRACK)