High severity · published Sep 12, 2016
CVE-2016-6371
Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allows remote attackers to write to…
7.5
CVSS
4.8%
EPSS
No
On KEV
Description
Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allows remote attackers to write to arbitrary files via a crafted URL, aka Bug ID CSCuz64717.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.8% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HC
Hosted Collaboration Mediation Fulfillment · Cisco
10.6(1)_base; 10.6(2)_base; 10.6(3)_base · source: NVD
Affected product
HC
Hosted Collaboration Mediation Fulfillment
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-6371
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-6371
Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-hcmf
Third Party Advisory
http://www.securityfocus.com/bid/92705
Third Party Advisory
http://www.securitytracker.com/id/1036719
More from Hosted Collaboration Mediation Fulfillment
7.5
CVE-2017-6779
Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration products that could allow an unauthenticated,…
6.5
CVE-2021-1478
A vulnerability in the Java Management Extensions (JMX) component of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management…
6.5
CVE-2020-3124
A vulnerability in the web-based interface of Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) could allow an unauthenticated, remote attacker to conduct a cross-site…
6.5
CVE-2018-15401
A vulnerability in the web-based management interface of Cisco Hosted Collaboration Mediation Fulfillment could allow an unauthenticated, remote attacker to conduct a cross-site…
6.5
CVE-2016-6454
A cross-site request forgery (CSRF) vulnerability in the web interface of the Cisco Hosted Collaboration Mediation Fulfillment application could allow an unauthenticated, remote…