Cisco Unified MeetingPlace Directory Enumeration Information Disclosure Vulnerability

Cisco Unified MeetingPlace software contains a vulnerability that could allow an unauthenticated, remote attacker to access sensitive information on a targeted system.

The vulnerability is due to an unspecified error in the affected software that could allow an attacker to enumerate existing folders via directory transversal sequences. An unauthenticated, remote attacker could exploit this vulnerability to access sensitive information on the system. The attacker could use this information to launch further attacks.

Cisco has confirmed this vulnerability and released software updates.

To exploit this vulnerability, an attacker would need to access trusted, internal networks. This access requirement decreases the likelihood of a successful exploit.