CVE-2013-3426

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

The Serviceability servlet on Cisco 9900 IP phones does not properly restrict paths, which allows remote attackers to read arbitrary files by specifying a pathname in a file request, aka Bug ID CSCuh52810.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published: Jul 18, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-34284.0The web interface in Cisco Secure Access Control System (ACS) does not properly suppress error-condition details, which allows remote authen CVE-2013-34297.8Multiple directory traversal vulnerabilities in Cisco Video Surveillance Manager (VSM) before 7.0.0 allow remote attackers to read system fi CVE-2013-34309.0Cisco Video Surveillance Manager (VSM) before 7.0.0 allows remote attackers to obtain sensitive configuration, archive, and log information CVE-2013-34317.8Cisco Video Surveillance Manager (VSM) before 7.0.0 does not require authentication for access to VSMC monitoring pages, which allows remote CVE-2013-34336.8Untrusted search path vulnerability in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(1a) allows local users to gain privile CVE-2013-34346.8Untrusted search path vulnerability in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(1a) allows local users to gain privile CVE-2013-34355.0The Cisco Unified IP Conference Station 7937G allows remote attackers to cause a denial of service (networking outage) via a flood of TCP pa CVE-2013-34365.0The default configuration of the Group Encrypted Transport VPN (GET VPN) feature on Cisco IOS uses an improper mechanism for enabling Group CVE-2013-34376.5SQL injection vulnerability in the management application in Cisco Unified Operations Manager allows remote authenticated users to execute a CVE-2013-34385.0The web framework in the server in Cisco Unified MeetingPlace Web Conferencing allows remote attackers to bypass intended access restriction CVE-2013-34394.3Cross-site scripting (XSS) vulnerability in Cisco Unified Operations Manager allows remote attackers to inject arbitrary web script or HTML CVE-2013-34404.3Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface in Cisco Unified Operations Manager allow remote att