CVE-2017-6758

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability in the web framework of Cisco Unified Communications Manager 11.5(1.10000.6) could allow an authenticated, remote attacker to access arbitrary files in the context of the web root directory structure on an affected device. The vulnerability is due to insufficient input validation by the affected software. An attacker could exploit this vulnerability by using directory traversal techniques to read files in the web root directory structure on the Cisco Unified Communications Manager filesystem. Cisco Bug IDs: CSCve13796.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	Cisco Unified Communications Manager	Cisco Unified Communications Manager

References

http://www.securityfocus.com/bid/100119Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039064Third Party Advisory, VDB Entry
https://quickview.cloudapps.cisco.com/quickview/bug/CSCve13796Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-ucm1Vendor Advisory
http://www.securityfocus.com/bid/100119Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039064Third Party Advisory, VDB Entry
https://quickview.cloudapps.cisco.com/quickview/bug/CSCve13796Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-ucm1Vendor Advisory

Timeline

Published: Aug 7, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-67596.5A vulnerability in the UpgradeManager of the Cisco Prime Collaboration Provisioning Tool 12.1 could allow an authenticated, remote attacker CVE-2017-67616.1A vulnerability in the web-based management interface of Cisco Finesse 10.6(1) and 11.5(1) could allow an unauthenticated, remote attacker t CVE-2017-67626.1A vulnerability in the web-based management interface of Cisco Jabber Guest Server 10.6(9), 11.0(0), and 11.0(1) could allow an unauthentica CVE-2017-67637.5A vulnerability in the implementation of the H.264 protocol in Cisco Meeting Server (CMS) 2.1.4 could allow an unauthenticated, remote attac CVE-2017-67645.4A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) 9.5(1) could allow an authenticated, remote CVE-2017-67656.1A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) 9.1(6.11) and 9.4(1.2) could allow an unaut CVE-2017-67667.5A vulnerability in the Secure Sockets Layer (SSL) Decryption and Inspection feature of Cisco Firepower System Software 5.4.0, 5.4.1, 6.0.0, CVE-2017-67677.1A vulnerability in Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to gain higher pr CVE-2017-67687.8A vulnerability in the build procedure for certain executable system files installed at boot time on Cisco Application Policy Infrastructure CVE-2017-67695.4A vulnerability in the web-based management interface of the Cisco Secure Access Control System (ACS) could allow an authenticated, remote a CVE-2017-67704.2Cisco IOS 12.0 through 15.6, Adaptive Security Appliance (ASA) Software 7.0.1 through 9.7.1.2, NX-OS 4.0 through 12.0, and IOS XE 3.6 throug CVE-2017-67717.5A vulnerability in the AutoVNF automation tool of the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to acqu