CVE-2011-3315 in the critical feed json
Directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x before 7.1(5b)SU2, and 8…
published 2011-10-27 15 y ago modified 2026-06-16 4 mo ago also EUVD-2011-3279
- cvss
- 7.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 25.7%
- EPSS 25.7% chance of exploitation in 30 days, percentile 97%
- public exploits
- 1
- Exploit-DB, plus a Nuclei check
Summary
Directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x before 7.1(5b)SU2, and 8.x before 8.0(3), and Cisco Unified Contact Center Express (aka Unified CCX or UCCX) and Cisco Unified IP Interactive Voice Response (Unified IP-IVR) before 6.0(1)SR1ES8, 7.0(x) before 7.0(2)ES1, 8.0(x) through 8.0(2)SU3, and 8.5(x) before 8.5(1)SU2, allows remote attackers to read arbitrary files via a crafted URL, aka Bug IDs CSCth09343 and CSCts44049.
Timeline
- First public exploit (EDB-36256)
- Published
Exploit prediction
25.75% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-36256 Cisco - 'file' Directory Traversal remote, 2011-10-26
- Nuclei template Cisco CUCM, UCCX, and Unified IP-IVR- Directory Traversal nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.8 | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
Sources
- CVE List CVE-2011-3315
- NVD CVE-2011-3315
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.