Cisco Unified Customer Voice Portal Log Viewer Arbitrary File Access Vulnerability

Bugtraq ID:	59741
Class:	Design Error
CVE:	CVE-2013-1223
Remote:	Yes
Local:	No
Published:	May 08 2013 12:00AM
Updated:	May 08 2013 12:00AM
Credit:	Alex Senkevitch
Vulnerable:	Cisco Unified Customer Voice Portal (CVP) 7.0(1) Cisco Unified Customer Voice Portal (CVP) 7.0 Cisco Unified Customer Voice Portal (CVP) 4.1(1)_ES11 Cisco Unified Customer Voice Portal (CVP) 4.1 Cisco Unified Customer Voice Portal (CVP) 4.0(2)_ES14 Cisco Unified Customer Voice Portal (CVP) 4.0
Not Vulnerable:

Cisco Unified Customer Voice Portal Log Viewer Arbitrary File Access Vulnerability

Cisco Unified Customer Voice Portal is prone to an arbitrary file-access vulnerability.

Successfully exploiting this issue may allow attackers to read arbitrary files. This may lead to further attacks.

This issue is being tracked by Cisco Bug ID CSCub38372.

Versions prior to Unified Customer Voice Portal (CVP) 9.0.1 ES 11 are vulnerable.

Cisco Unified Customer Voice Portal Log Viewer Arbitrary File Access Vulnerability

An attacker can exploit this issue using a web browser.

Cisco Unified Customer Voice Portal Log Viewer Arbitrary File Access Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cisco Unified Customer Voice Portal Log Viewer Arbitrary File Access Vulnerability

References:

• Cisco Unified Customer Voice Portal Product Page (Cisco)