Cisco Unified Customer Voice Portal CVE-2013-1224 Directory Traversal Vulnerability

Bugtraq ID:	59743
Class:	Input Validation Error
CVE:	CVE-2013-1224
Remote:	Yes
Local:	No
Published:	May 08 2013 12:00AM
Updated:	May 08 2013 12:00AM
Credit:	Alex Senkevitch
Vulnerable:	Cisco Unified Customer Voice Portal (CVP) 7.0(1) Cisco Unified Customer Voice Portal (CVP) 7.0 Cisco Unified Customer Voice Portal (CVP) 4.1(1)_ES11 Cisco Unified Customer Voice Portal (CVP) 4.1 Cisco Unified Customer Voice Portal (CVP) 4.0(2)_ES14 Cisco Unified Customer Voice Portal (CVP) 4.0
Not Vulnerable:

Cisco Unified Customer Voice Portal CVE-2013-1224 Directory Traversal Vulnerability

Cisco Unified Customer Voice Portal is prone to a directory-traversal vulnerability.

A remote attacker can use directory-traversal strings to modify arbitrary system files in the context of the affected application. This may aid in further attacks.

This issue is being tracked by Cisco Bug ID CSCub38369.

Versions prior to Unified Customer Voice Portal (CVP) 9.0.1 ES 11 are vulnerable.

Cisco Unified Customer Voice Portal CVE-2013-1224 Directory Traversal Vulnerability

An attacker can exploit the issue through a browser.

Cisco Unified Customer Voice Portal CVE-2013-1224 Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cisco Unified Customer Voice Portal CVE-2013-1224 Directory Traversal Vulnerability

References:

• Cisco Homepage (Cisco )
  
• Cisco Unified Customer Voice Portal Product Page (Cisco)
  
• Multiple Vulnerabilities in Cisco Unified Customer Voice Portal Software (Cisco)