Vulnerability Name:

CVE-2008-4545 (CCN-45742)

Assigned:2008-10-08
Published:2008-10-08
Updated:2017-08-08
Summary:Cisco Unity 4.x before 4.2(1)ES161, 5.x before 5.0(1)ES53, and 7.x before 7.0(2)ES8 uses weak permissions for the D:\CommServer\Reports directory, which allows remote authenticated users to obtain sensitive information by reading files in this directory.
CVSS v3 Severity:3.5 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
3.0 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
3.0 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-264
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2008-4545

Source: CCN
Type: SA32187
Cisco Unity Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
32187

Source: CCN
Type: SECTRACK ID: 1021022
Cisco Unity Discloses Reports to Local and Remote Authenticated Users

Source: SECTRACK
Type: UNKNOWN
1021022

Source: CISCO
Type: Vendor Advisory
20081008 VoIPshield Reported Vulnerabilities in Cisco Unity Server

Source: CCN
Type: cisco-sr-20081008-unity
Cisco Security Response: VoIPshield Reported Vulnerabilities in Cisco Unity Server

Source: CCN
Type: OSVDB ID: 49833
Cisco Unity CommServer\Reports Directory Permission Weakness

Source: BID
Type: UNKNOWN
31642

Source: CCN
Type: BID-31642
Cisco Unity 7.0 Multiple Remote Vulnerabilities

Source: CCN
Type: VoIP Security Advisory, 2008-10-08
Cisco Unity Reports Information Disclosure

Source: MISC
Type: UNKNOWN
http://www.voipshield.com/research-details.php?id=130

Source: VUPEN
Type: UNKNOWN
ADV-2008-2771

Source: XF
Type: UNKNOWN
unityserver-reports-information-disclosure(45742)

Source: XF
Type: UNKNOWN
unityserver-reports-information-disclosure(45742)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:cisco:unity:4.0:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:unity:4.0(1):*:*:*:*:*:*:*
  • OR cpe:/a:cisco:unity:4.0(2):*:*:*:*:*:*:*
  • OR cpe:/a:cisco:unity:4.0(3):*:*:*:*:*:*:*
  • OR cpe:/a:cisco:unity:4.0(3):sr2:*:*:*:*:*:*
  • OR cpe:/a:cisco:unity:4.0(4):*:*:*:*:*:*:*
  • OR cpe:/a:cisco:unity:4.0(4):sr1:*:*:*:*:*:*
  • OR cpe:/a:cisco:unity:4.0(5):*:*:*:*:*:*:*
  • OR cpe:/a:cisco:unity:4.1(1):*:*:*:*:*:*:*
  • OR cpe:/a:cisco:unity:*:*:*:*:*:*:*:* (Version <= 4.2(1))
  • OR cpe:/a:cisco:unity:5.0:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:unity:*:*:*:*:*:*:*:* (Version <= 5.0(1))
  • OR cpe:/a:cisco:unity:7.0:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:unity:*:*:*:*:*:*:*:* (Version <= 7.0(2))

    • Configuration CCN 1:
  • cpe:/h:cisco:unity_server:4.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    cisco unity 4.0
    cisco unity 4.0(1)
    cisco unity 4.0(2)
    cisco unity 4.0(3)
    cisco unity 4.0(3) sr2
    cisco unity 4.0(4)
    cisco unity 4.0(4) sr1
    cisco unity 4.0(5)
    cisco unity 4.1(1)
    cisco unity *
    cisco unity 5.0
    cisco unity *
    cisco unity 7.0
    cisco unity *
    cisco unity server 4.0