CVE-2015-4684

published 2017-09-19

CVE-2015-4684: Multiple directory traversal vulnerabilities in Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allow (1) remote authenticated users to read…

Priority P3 43 medium 6.5 CVSS 3.0

AV N AC L PR H UI N S U C H I H A N

EXPLOIT

Multiple directory traversal vulnerabilities in Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allow (1) remote authenticated users to read arbitrary files via a .. (dot dot) in the Modifier parameter to PlcmRmWeb/FileDownload; or remote authenticated administrators to upload arbitrary files via the (2) Filename or (3) SE_FNAME parameter to PlcmRmWeb/FileUpload or to read and remove arbitrary files via the (4) filePathName parameter in an importSipUriReservations SOAP request to PlcmRmWeb/JUserManager.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
polycom	realpresence_resource_manager	<= 8.3.2	—

CVSS provenance

nvd v3.0 6.5 MEDIUM CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

nvd v2.0 5.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-255