Medium severity · published Sep 12, 2016
CVE-2016-6370
Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allows remote authenticated users to read…
4.3
CVSS
2.4%
EPSS
No
On KEV
Description
Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allows remote authenticated users to read arbitrary files via a crafted pathname in an HTTP request, aka Bug ID CSCuz27255.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HC
Hosted Collaboration Mediation Fulfillment · Cisco
10.6(1)_base; 10.6(2)_base; 10.6(3)_base · source: NVD
Affected product
HC
Hosted Collaboration Mediation Fulfillment
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-6370
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-6370
Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-hcm
Third Party Advisory
http://www.securityfocus.com/bid/92704
Third Party Advisory
http://www.securitytracker.com/id/1036718
More from Hosted Collaboration Mediation Fulfillment
7.5
CVE-2017-6779
Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration products that could allow an unauthenticated,…
7.5
CVE-2016-6371
Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allows remote attackers to write to…
6.5
CVE-2021-1478
A vulnerability in the Java Management Extensions (JMX) component of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management…
6.5
CVE-2020-3124
A vulnerability in the web-based interface of Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) could allow an unauthenticated, remote attacker to conduct a cross-site…
6.5
CVE-2018-15401
A vulnerability in the web-based management interface of Cisco Hosted Collaboration Mediation Fulfillment could allow an unauthenticated, remote attacker to conduct a cross-site…