{"api_version":"1","generated_at":"2026-07-23T09:55:44+00:00","cve":"CVE-2017-6758","urls":{"html":"https://cve.report/CVE-2017-6758","api":"https://cve.report/api/cve/CVE-2017-6758.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-6758","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-6758"},"summary":{"title":"CVE-2017-6758","description":"A vulnerability in the web framework of Cisco Unified Communications Manager 11.5(1.10000.6) could allow an authenticated, remote attacker to access arbitrary files in the context of the web root directory structure on an affected device. The vulnerability is due to insufficient input validation by the affected software. An attacker could exploit this vulnerability by using directory traversal techniques to read files in the web root directory structure on the Cisco Unified Communications Manager filesystem. Cisco Bug IDs: CSCve13796.","state":"PUBLISHED","assigner":"cisco","published_at":"2017-08-07 06:29:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-22","CWE-22 CWE-22"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.8","severity":"","vector":"AV:N/AC:L/Au:S/C:C/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:N/A:N","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-ucm1","name":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-ucm1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Cisco Unified Communications Manager Directory Traversal Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://quickview.cloudapps.cisco.com/quickview/bug/CSCve13796","name":"https://quickview.cloudapps.cisco.com/quickview/bug/CSCve13796","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Cisco Bug: CSCve13796 - Cisco Unified Communications Manager Directory Traversal Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1039064","name":"http://www.securitytracker.com/id/1039064","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Cisco Unified Communications Manager Lets Remote Authenticated Users Traverse the Directory to View Files on the Target System - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/100119","name":"http://www.securityfocus.com/bid/100119","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Cisco Unified Communications Manager CVE-2017-6758 Directory Traversal Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-6758","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6758","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"Cisco Unified Communications Manager","version":"affected Cisco Unified Communications Manager","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"6758","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"unified_communications_manager","cpe6":"11.5\\(1.10000.6\\)","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T15:41:17.552Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"100119","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/100119"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-ucm1"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://quickview.cloudapps.cisco.com/quickview/bug/CSCve13796"},{"name":"1039064","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1039064"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"Cisco Unified Communications Manager","vendor":"n/a","versions":[{"status":"affected","version":"Cisco Unified Communications Manager"}]}],"datePublic":"2017-08-07T00:00:00.000Z","descriptions":[{"lang":"en","value":"A vulnerability in the web framework of Cisco Unified Communications Manager 11.5(1.10000.6) could allow an authenticated, remote attacker to access arbitrary files in the context of the web root directory structure on an affected device. The vulnerability is due to insufficient input validation by the affected software. An attacker could exploit this vulnerability by using directory traversal techniques to read files in the web root directory structure on the Cisco Unified Communications Manager filesystem. Cisco Bug IDs: CSCve13796."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2017-08-07T09:57:02.000Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco"},"references":[{"name":"100119","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/100119"},{"tags":["x_refsource_CONFIRM"],"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-ucm1"},{"tags":["x_refsource_CONFIRM"],"url":"https://quickview.cloudapps.cisco.com/quickview/bug/CSCve13796"},{"name":"1039064","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1039064"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@cisco.com","ID":"CVE-2017-6758","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Cisco Unified Communications Manager","version":{"version_data":[{"version_value":"Cisco Unified Communications Manager"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A vulnerability in the web framework of Cisco Unified Communications Manager 11.5(1.10000.6) could allow an authenticated, remote attacker to access arbitrary files in the context of the web root directory structure on an affected device. The vulnerability is due to insufficient input validation by the affected software. An attacker could exploit this vulnerability by using directory traversal techniques to read files in the web root directory structure on the Cisco Unified Communications Manager filesystem. Cisco Bug IDs: CSCve13796."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-22"}]}]},"references":{"reference_data":[{"name":"100119","refsource":"BID","url":"http://www.securityfocus.com/bid/100119"},{"name":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-ucm1","refsource":"CONFIRM","url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-ucm1"},{"name":"https://quickview.cloudapps.cisco.com/quickview/bug/CSCve13796","refsource":"CONFIRM","url":"https://quickview.cloudapps.cisco.com/quickview/bug/CSCve13796"},{"name":"1039064","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1039064"}]}}}},"cveMetadata":{"assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","assignerShortName":"cisco","cveId":"CVE-2017-6758","datePublished":"2017-08-07T06:00:00.000Z","dateReserved":"2017-03-09T00:00:00.000Z","dateUpdated":"2024-08-05T15:41:17.552Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-08-07 06:29:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-22","CWE-22 CWE-22"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:N/A:N","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8,"impactScore":6.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:unified_communications_manager:11.5\\(1.10000.6\\):*:*:*:*:*:*:*","matchCriteriaId":"21BFC3A9-B6B1-49EE-A93A-6432BFE33E84"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"6758","Ordinal":"1","Title":"CVE-2017-6758","CVE":"CVE-2017-6758","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"6758","Ordinal":"1","NoteData":"A vulnerability in the web framework of Cisco Unified Communications Manager 11.5(1.10000.6) could allow an authenticated, remote attacker to access arbitrary files in the context of the web root directory structure on an affected device. The vulnerability is due to insufficient input validation by the affected software. An attacker could exploit this vulnerability by using directory traversal techniques to read files in the web root directory structure on the Cisco Unified Communications Manager filesystem. Cisco Bug IDs: CSCve13796.","Type":"Description","Title":"CVE-2017-6758"},{"CveYear":"2017","CveId":"6758","Ordinal":"2","NoteData":"2017-08-07","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"6758","Ordinal":"3","NoteData":"2017-08-07","Type":"Other","Title":"Modified"}]}}}