Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-2145

Directory traversal vulnerability in the messaging API in Cisco Unity Connection allows remote authenticated users to read arbitrary files via vectors related to unenforced access constraints for .wav files and the audio/x-wav MIME type, aka Bug ID CSCun91071.

Published

2014-04-05T04:01:38.700

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.0 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

8.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-22

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	cisco	unity_connection	-	Yes

References

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2145 Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/66676 ([email protected])
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2145 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/66676 (af854a3a-2127-422b-91ae-364da2661108)