A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), and Cisco Unity Connection could allow an authenticated, remote attacker to access sensitive data on an affected device. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to access sensitive files on the affected system.

The version of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) installed on the remote host is prior to 14SU1. It is, therefore, affected by a path traversal vulnerability in the web-based management interface that allows an authenticated, remote attacker to access sensitive data. This is caused by improperly validated data.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Cisco Unity Connection installed on the remote host is prior to 14SU1. It is, therefore, affected by a path traversal vulnerability in the web-based management interface that allows an authenticated, remote attacker to access sensitive data. This is caused by improperly validated data.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Self Care Portal of Cisco Unified Communications Manager (Unified CM) is affected by a path traversal vulnerability in its web-based management interface due to a failure to properly validate user input. An authenticated, remote attacker can exploit this, by sending a URI that contains path traversal characters, to disclose the contents of files located outside of the server's restricted path.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

ID	Name	Product	Family	Severity
154931	Cisco Unified Communications Manager IM & Presence Service Path Traversal (cisco-sa-cucm-path-trav-dKCvktvO)	Nessus	CISCO	medium
154930	Cisco Unity Connect Path Traversal (cisco-sa-cucm-path-trav-dKCvktvO)	Nessus	CISCO	medium
154929	Cisco Unified Communications Manager Path Traversal (cisco-sa-cucm-path-trav-dKCvktvO)	Nessus	CISCO	medium

Detections

Analytics

CVE-2021-34701

medium

Tenable Plugins

medium

medium

medium