Cisco Unified Customer Voice Portal Multiple Vulnerabilities

Multiple vulnerabilities has been identified in Cisco Unified Customer Voice Portal. A remote user can execute arbitrary applications on the target system, cause denial of service conditions, view and modify files on the target system, and gain administrator access.

1. A remote user can send a specially crafted SIP INVITE message to trigger a flaw in the the CallServer component and cause the system to not accept new calls.
2. A remote user can exploit a flaw in the Tomcat web application to gain administrator access.
3. A remote user can exploit a flaw in the Tomcat web application to execute unauthorized user-supplied web applications.
4. A remote user can exploit a parameter validation and file access flaw in the log viewer to view arbitrary system files.
5. A remote user can exploit a parameter validation path traversal flaw in Resource Manager component to overwrite system files.
6. A remote user can exploit an XML entity expansion flaw to view arbitrary system files.