How severe is CVE-2017-6629?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 5.3 out of 10.

What type of vulnerability is CVE-2017-6629?

This is classified as CWE-22, which is a common weakness in software security.

CVE-2017-6629 - MEDIUM Severity | CVSS 5.3

Vulnerability Description

A vulnerability in the ImageID parameter of Cisco Unity Connection 10.5(2) could allow an unauthenticated, remote attacker to access files in arbitrary locations on the filesystem of an affected device. The issue is due to improper sanitization of user-supplied input in HTTP POST parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. Cisco Bug IDs: CSCvd90118.

Related Vulnerabilities

CVE-2012-3337

MEDIUM

CVSS:5.3(Medium)

IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" se...

CWE-222012

CVE-2013-2565

MEDIUM

CVSS:5.3(Medium)

A vulnerability in Mambo CMS v4.6.5 where the scripts thumbs.php, editorFrame.php, editor.php, images.php, manager.php discloses the root path of the webserver.

CWE-222013

CVE-2014-125068

MEDIUM

CVSS:5.3(Medium)

A vulnerability was found in saxman maps-js-icoads and classified as critical. This issue affects some unknown processing of the file http-server.js. The manipulation leads to path traversal. The patc...

CWE-222014

CVE-2014-3972

MEDIUM

CVSS:5.3(Medium)

Directory traversal vulnerability in Apexis APM-J601-WS cameras with firmware before 17.35.2.49 allows remote attackers to read arbitrary files via unspecified vectors.

CWE-222014

CVE-2014-7174

MEDIUM

CVSS:5.3(Medium)

FarLinX X25 Gateway through 2014-09-25 allows directory traversal via the log-handling feature.

CWE-222014

CVE-2014-8676

MEDIUM

CVSS:5.3(Medium)

Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) in a URL pat...

CWE-222014