CVE-2013-5534 — MEDIUM (4.0)

Vulnerability Description

Directory traversal vulnerability in the attachment service in the Voice Message Web Service (aka VMWS or Cisco Unity Web Service) in Cisco Unity Connection allows remote authenticated users to create files, and consequently execute arbitrary JSP code, via a crafted pathname for a file that is not a valid audio file, aka Bug ID CSCuj22948.

CVSS Score

4.0

MEDIUM

AV:N/AC:L/Au:S/C:N/I:P/A:N

Confidentiality

NONE

Integrity

PARTIAL

Availability

NONE

Affected Products

Vendor	Product	Versions
Cisco	Unity Connection	-

Related Weaknesses (CWE)

CWE-22

References

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5534Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5534Vendor Advisory

FAQ

What is CVE-2013-5534?

CVE-2013-5534 is a vulnerability with a CVSS score of 4.0 (MEDIUM). Directory traversal vulnerability in the attachment service in the Voice Message Web Service (aka VMWS or Cisco Unity Web Service) in Cisco Unity Connection allows remote authenticated users to create...

How severe is CVE-2013-5534?

CVE-2013-5534 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2013-5534?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Unity Connection.