CVE-2013-1224

2013-05-09 14:31:19 2013-07-08 06:00:00

Directory traversal vulnerability in the Resource Manager in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 allows remote attackers to overwrite arbitrary files via a crafted (1) HTTP or (2) HTTPS request that triggers incorrect parameter validation, aka Bug ID CSCub38369.

Vector

NETWORK

Complexity

LOW

Authentication

NONE

Confidentiality

NONE

Integrity

COMPLETE

Availability

NONE

Cisco CatOS 5.5 (6) Cisco CatOS 5.5 (5) Cisco CatOS 5.5 (4b) Cisco CatOS 5.5 (2) Cisco CatOS 5.5 (3) Cisco CatOS 5.5 (18) Cisco CatOS 5.5 (16) Cisco CatOS 5.5 (16.2) Cisco CatOS 5.5 (17) Cisco CatOS 5.5 (19) Cisco CatOS 5.5 (1a) Cisco CatOS 5.5 (4) Cisco CatOS 5.5 (4a)

Cisco - Unified customer voice portal

Advisory	Patch	Confirmed	Link
			20130508 Multiple Vulnerabilities in Cisco Unified Custo...

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (ID 22)

Related CAPEC 7 Relative Path Traversal (CAPEC-ID 139) Directory Traversal (CAPEC-ID 213) File System Function Injection, Content Based (CAPEC-ID 23) Using Slashes and URL Encoding Combined to Bypass Validation Logic (CAPEC-ID 64) Manipulating Input to File System Calls (CAPEC-ID 76) Using Escaped Slashes in Alternate Encoding (CAPEC-ID 78) Using Slashes in Alternate Encoding (CAPEC-ID 79)