CVE-2014-3318
published 2014-07-10CVE-2014-3318: Directory traversal vulnerability in dna/viewfilecontents.do in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows…
PriorityP426medium4CVSS 2.0
AVNACLAuSCPINAN
EPSS
2.98%
85.9th percentile
Directory traversal vulnerability in dna/viewfilecontents.do in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup76318.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | unified_communications_manager | — | — |
CVSS provenance
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_cisco4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Unified Communications Manager DNA Path Traversal Vulnerability
vendor_cisco·2014-07-10·CVSS 4.0
CVE-2014-3318 [MEDIUM] CWE-22 Cisco Unified Communications Manager DNA Path Traversal Vulnerability
Cisco Unified Communications Manager DNA Path Traversal Vulnerability
A vulnerability in the /dna/viewfilecontents.do URL of the Cisco Unified Communications Manager Dialed Number Analyzer (DNA) could allow an authenticated, remote attacker to view files from specific locations on the filesystem.
The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting crafted URL
requests to a vulnerable device.
Cisco has confirmed the vulnerability in a security notice; however, software updates are not available.
To exploit this vulnerability, an attacker must authenticate to a targeted system. This access requirement may reduce the likelihood of a successful exploit.
Cisco indicates through the CVSS score that functional exploit code ex
GHSA
GHSA-9rgx-hh7j-v8gc: Directory traversal vulnerability in dna/viewfilecontents
ghsa_unreviewed·2022-05-17
CVE-2014-3318 [MEDIUM] CWE-20 GHSA-9rgx-hh7j-v8gc: Directory traversal vulnerability in dna/viewfilecontents
Directory traversal vulnerability in dna/viewfilecontents.do in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup76318.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://secunia.com/advisories/59728http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3318http://tools.cisco.com/security/center/viewAlert.x?alertId=34897http://www.securityfocus.com/bid/68482http://www.securitytracker.com/id/1030554https://exchange.xforce.ibmcloud.com/vulnerabilities/94433http://secunia.com/advisories/59728http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3318http://tools.cisco.com/security/center/viewAlert.x?alertId=34897http://www.securityfocus.com/bid/68482http://www.securitytracker.com/id/1030554https://exchange.xforce.ibmcloud.com/vulnerabilities/94433
2014-07-10
Published