CVE-2016-6370
published 2016-09-12CVE-2016-6370: Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allows remote…
PriorityP427medium4.3CVSS 3.0
AVNACLPRLUINSUCLINAN
EPSS
2.38%
82.2th percentile
Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allows remote authenticated users to read arbitrary files via a crafted pathname in an HTTP request, aka Bug ID CSCuz27255.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | hosted_collaboration_mediation_fulfillment | — | — |
| cisco | hosted_collaboration_mediation_fulfillment | — | — |
| cisco | hosted_collaboration_mediation_fulfillment | — | — |
| cisco | hosted_collaboration_mediation_fulfillment_authenticated_directory | — | — |
CVSS provenance
nvdv3.04.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_cisco4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6cqx-qc5v-r3pg: Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10
ghsa_unreviewed·2022-05-17
CVE-2016-6370 [MEDIUM] CWE-22 GHSA-6cqx-qc5v-r3pg: Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10
Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allows remote authenticated users to read arbitrary files via a crafted pathname in an HTTP request, aka Bug ID CSCuz27255.
Cisco
Cisco Hosted Collaboration Mediation Fulfillment Authenticated Directory Traversal Vulnerability
vendor_cisco·2016-08-31·CVSS 4.0
CVE-2016-6370 [MEDIUM] CWE-22 Cisco Hosted Collaboration Mediation Fulfillment Authenticated Directory Traversal Vulnerability
Cisco Hosted Collaboration Mediation Fulfillment Authenticated Directory Traversal Vulnerability
A vulnerability in the web interface of Cisco Hosted Collaboration Mediation Fulfillment could allow an authenticated, remote attacker to access arbitrary files on the system. This vulnerability allows the attacker to perform directory traversal.
The vulnerability is due to a lack of proper input verification and sanitization of the user input directory path. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. An exploit could allow the attacker to read arbitrary files on the system that should be restricted.
Cisco has not released software updates that address this vulnerability. Workarounds that address this vulnerability are not available
Cisco
Cisco Hosted Collaboration Mediation Fulfillment Authenticated Directory Traversal Vulnerability
vendor_cisco
CVE-2016-6370 Cisco Hosted Collaboration Mediation Fulfillment Authenticated Directory Traversal Vulnerability
CVE-2016-6370: Cisco Hosted Collaboration Mediation Fulfillment Authenticated Directory Traversal Vulnerability
A vulnerability in the web interface of Cisco Hosted Collaboration Mediation Fulfillment could allow an authenticated, remote attacker to access arbitrary files on the system. This vulnerability allows the attacker to perform directory traversal. The vulnerability is due to a lack of proper input verification and sanitization of the user input directory path. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. An exploit could allow the attacker to read arbitrary files on the system that should be restricted. Cisco has not released software updates that address this vulnerability.
CWE: CWE-22, CWE-22
Bug IDs: CSCuz27255
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-hcmhttp://www.securityfocus.com/bid/92704http://www.securitytracker.com/id/1036718http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-hcmhttp://www.securityfocus.com/bid/92704http://www.securitytracker.com/id/1036718
2016-09-12
Published