Cisco Unity Connection Arbitrary File Download Vulnerability

Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnerabilities, the attacker must have valid administrative credentials.  These vulnerabilities are due to improper sanitization of user input to the web-based management interface. An attacker could exploit these vulnerabilities by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from an affected system.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

相对路径遍历

Cisco Unity Connection 安全漏洞

Cisco Unity Connection（UC）是美国思科（Cisco）公司的一套语音留言平台。该平台可利用语音命令，以免提方式拨打电话或收听留言。 Cisco Unity Connection存在安全漏洞，该漏洞源于基于Web的管理界面用户输入清理不当，可能导致经过身份验证的远程攻击者下载任意文件。

N/A

N/A