Unrestricted file upload vulnerability in the Custom Prompts upload implementation in Cisco Unified MeetingPlace 8.6(1.9) allows remote authenticated users to execute arbitrary code by using the languageShortName parameter to upload a file that provides shell access, aka Bug ID CSCus95712.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0702
Reference (s):
- CISCO:20150420 Cisco Unified MeetingPlace Custom Prompts languageShortName Parameter Arbitrary Code Execution Vulnerability
- URL: http://tools.cisco.com/security/center/viewAlert.x?alertId=38455
- SECTRACK:1032165
- URL: http://www.securitytracker.com/id/1032165