CVE-2013-5534

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-10-19 · updated 2026-06-16
Weakness: CWE-22

Description

Directory traversal vulnerability in the attachment service in the Voice Message Web Service (aka VMWS or Cisco Unity Web Service) in Cisco Unity Connection allows remote authenticated users to create files, and consequently execute arbitrary JSP code, via a crafted pathname for a file that is not a valid audio file, aka Bug ID CSCuj22948.

Affected products

Cisco Unity Connection: all versions

References

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5534
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5534

Get alerted when CVE-2013-5534 or the next vulnerability affects your stack