CVE-2010-1571

Directory traversal vulnerability in the bootstrap service in Cisco Unified Contact Center Express (UCCX) 7.0 before 7.0(1)SR4 and 7.0(2), unspecified 6.0 versions, and 5.0 before 5.0(2)SR3 allows remote attackers to read arbitrary files via a crafted bootstrap message to TCP port 6295.

CVSS v2.0 7.8 HIGH

7.8^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:N/A:N

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securitytracker.com/id?1024082
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2f110.shtml	Patch Vendor Advisory
http://www.securityfocus.com/bid/40680
https://exchange.xforce.ibmcloud.com/vulnerabilities/59277

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:unified_contact_center_express:7.0:::::::*
	cpe:2.3:a:cisco:unified_contact_center_express:6.0:::::::*
	cpe:2.3:a:cisco:unified_contact_center_express:5.0:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:cisco:customer_response_solution:6.0:::::::*
	cpe:2.3:a:cisco:customer_response_solution:7.0:::::::*
	cpe:2.3:a:cisco:customer_response_solution:5.0:::::::*

Configuration 3 (hide)

OR	cpe:2.3:a:cisco:unified_ip_interactive_voice_response:5.0:::::::*
	cpe:2.3:a:cisco:unified_ip_interactive_voice_response:6.0:::::::*
	cpe:2.3:a:cisco:unified_ip_interactive_voice_response:7.0:::::::*

Information

Published : 2010-06-09 17:30

Updated : 2017-08-16 18:32

NVD link : CVE-2010-1571

Mitre link : CVE-2010-1571

JSON object : View

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Products Affected

cisco

customer_response_solution
unified_ip_interactive_voice_response
unified_contact_center_express

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securitytracker.com/id?1024082", "name": "1024082", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2f110.shtml", "name": "20100609 Vulnerabilities in Cisco Unified Contact Center Express", "tags": ["Patch", "Vendor Advisory"], "refsource": "CISCO"}, {"url": "http://www.securityfocus.com/bid/40680", "name": "40680", "tags": [], "refsource": "BID"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59277", "name": "cisco-unified-bootstrap-dir-traversal(59277)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Directory traversal vulnerability in the bootstrap service in Cisco Unified Contact Center Express (UCCX) 7.0 before 7.0(1)SR4 and 7.0(2), unspecified 6.0 versions, and 5.0 before 5.0(2)SR3 allows remote attackers to read arbitrary files via a crafted bootstrap message to TCP port 6295."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-22"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2010-1571", "ASSIGNER": "psirt@cisco.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 6.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2010-06-10T00:30Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:cisco:unified_contact_center_express:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:cisco:unified_contact_center_express:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:cisco:unified_contact_center_express:5.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:cisco:customer_response_solution:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:cisco:customer_response_solution:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:cisco:customer_response_solution:5.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:cisco:unified_ip_interactive_voice_response:5.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:cisco:unified_ip_interactive_voice_response:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:cisco:unified_ip_interactive_voice_response:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-08-17T01:32Z"}

7.8 /10