CVE-2020-3130 Cisco Unity Connection Directory Traversal Vulnerability
Authenticated attackers can overwrite files on the underlying filesystem via crafted HTTP requests in the web management interface.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-3130?
CVE-2020-3130 is a medium-severity path traversal vulnerability in Cisco Unity Connection, published on 23 Sep 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability in the web management interface of Cisco Unity Connection could allow an authenticated remote attacker to overwrite files on the underlying filesystem. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web management interface. A successful exploit could allow the attacker to overwrite files on the underlying filesystem of an affected system. Valid administrator credentials are required to access the system.
Which versions are affected by CVE-2020-3130?
It affects 1 product.
Products include Cisco Unity Connection.
How do I fix CVE-2020-3130?
No fix has been published for CVE-2020-3130 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-3130 being exploited?
There is no known exploitation of CVE-2020-3130 in the wild and no public exploit code.
Other vulnerabilities in Cisco Unity Connection
Sources
Also known as GHSA-3rxc-xqq7-hm3h.