CVE-2020-3130 MEDIUM

CVE-2020-3130: Cisco Unity Connection Directory Traversal Vulnerability

Vendor Cisco
Product Cisco Unity Connection
Weakness CWE-22 · Path traversal
Published September 23, 2020
Last update November 13, 2024

CVSS base score

5.9/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H

What the vulnerability does

01Description

A vulnerability in the web management interface of Cisco Unity Connection could allow an authenticated remote attacker to overwrite files on the underlying filesystem. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web management interface. A successful exploit could allow the attacker to overwrite files on the underlying filesystem of an affected system. Valid administrator credentials are required to access the system.

Key dates

02Disclosure timeline

September 23, 2020 CVE published
November 13, 2024 Record updated