Vulnerability · Published Nov 4, 2021 · Assigned by cisco

CVE-2021-34701Cisco Unified Communications Products Path Traversal Vulnerability

Medium 4.3

In plain English

A medium-severity path traversal in Cisco Unity Connection from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 75% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)1.6%top 24.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), and Cisco Unity Connection could allow an authenticated, remote attacker to access sensitive data on an affected device. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to access sensitive files on the affected system.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco Unity Connection	n/a

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

20211103 Cisco Unified Communications Products Path Traversal Vulnerability vendor-advisory, x_refsource_CISCO