CVE-2010-1571

Directory traversal vulnerability in the bootstrap service in Cisco Unified Contact Center Express (UCCX) 7.0 before 7.0(1)SR4 and 7.0(2), unspecified 6.0 versions, and 5.0 before 5.0(2)SR3 allows remote attackers to read arbitrary files via a crafted bootstrap message to TCP port 6295.

CVSS v2.0 7.8 HIGH

7.8^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:N/A:N

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2f110.shtml	Patch Vendor Advisory
http://www.securityfocus.com/bid/40680
http://www.securitytracker.com/id?1024082
https://exchange.xforce.ibmcloud.com/vulnerabilities/59277

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:unified_contact_center_express:5.0:::::::*
	cpe:2.3:a:cisco:unified_contact_center_express:6.0:::::::*
	cpe:2.3:a:cisco:unified_contact_center_express:7.0:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:cisco:customer_response_solution:5.0:::::::*
	cpe:2.3:a:cisco:customer_response_solution:6.0:::::::*
	cpe:2.3:a:cisco:customer_response_solution:7.0:::::::*

Configuration 3 (hide)

OR	cpe:2.3:a:cisco:unified_ip_interactive_voice_response:5.0:::::::*
	cpe:2.3:a:cisco:unified_ip_interactive_voice_response:6.0:::::::*
	cpe:2.3:a:cisco:unified_ip_interactive_voice_response:7.0:::::::*

History

No history.

Information

Published : 2010-06-10 00:30

Updated : 2023-12-10 11:03

NVD link : CVE-2010-1571

Mitre link : CVE-2010-1571

CVE.ORG link : CVE-2010-1571

JSON object : View

Products Affected

cisco

customer_response_solution
unified_contact_center_express
unified_ip_interactive_voice_response

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2010-1571", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2010-06-10T00:30:07.440", "references": [{"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2f110.shtml", "tags": ["Patch", "Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/40680", "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id?1024082", "source": "ykramarz@cisco.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59277", "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in the bootstrap service in Cisco Unified Contact Center Express (UCCX) 7.0 before 7.0(1)SR4 and 7.0(2), unspecified 6.0 versions, and 5.0 before 5.0(2)SR3 allows remote attackers to read arbitrary files via a crafted bootstrap message to TCP port 6295."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en el servicio bootstrap en Cisco Unified Contact Center Express (UCCX) v7.0 anterior v7.0(1)SR4 y 7.0(2), no especificadas versiones v6.0, y v5.0 anterior v5.0(2)SR3 permite a atacantes remotos leer ficheros de su elecci\u00f3n a trav\u00e9s de un mensaje bootstrap manipulado en el puerto TCP 6295"}], "lastModified": "2017-08-17T01:32:24.507", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:unified_contact_center_express:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94802F97-66DB-4D44-84B3-C3A809D482BE"}, {"criteria": "cpe:2.3:a:cisco:unified_contact_center_express:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "48B1E1B7-0552-4DF4-BFF5-2F23A2A3984D"}, {"criteria": "cpe:2.3:a:cisco:unified_contact_center_express:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A1A17849-7F58-47C5-8A76-40C9FD67575E"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:customer_response_solution:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "490A758F-AB9B-4316-BB13-ED3AD42C08EC"}, {"criteria": "cpe:2.3:a:cisco:customer_response_solution:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B8DE417-5CF4-4622-90A4-56668E9AADDD"}, {"criteria": "cpe:2.3:a:cisco:customer_response_solution:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81B117ED-4D28-4A21-9025-59C22B9F4987"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:unified_ip_interactive_voice_response:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D336E75-FDE5-45CF-B9EB-789353ADE92C"}, {"criteria": "cpe:2.3:a:cisco:unified_ip_interactive_voice_response:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87ED508C-552E-4149-AAC5-42F02B771961"}, {"criteria": "cpe:2.3:a:cisco:unified_ip_interactive_voice_response:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D92FB838-53A8-46DA-8F43-9B2B63E3033E"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}