CVE:CVE-2021-34701
CNNVD:CNNVD-202111-369
Cisco Unity Connection（UC）和Cisco Unified Communications Manager（CUCM，Unified CM，CallManager）都是美国思科（Cisco）公司的产品。Cisco Unity Connection是一套语音留言平台。该平台可利用语音命令，以免提方式拨打电话或收听留言。Cisco Unified Communications Manager是一款统一通信系统中的呼叫处理组件。该组件提供了一种可扩展、可分布和高可用的企业IP电话呼叫处理解决方案。
Cisco Unity Connection（UC）和Cisco Unified Communications Manager 存在路径遍历漏洞，该漏洞源于基于 Web 的管理界面中的漏洞可能允许经过身份验证的远程攻击者访问受影响设备上的敏感数据。
solution:Upgrade cisco unified_communications_manager to a higher version than 14su1,and avoid the version (,14su1); Upgrade cisco unified_communications_manager_im_and_presence_service to a higher version than 14su1,and avoid the version (,14su1); Upgrade cisco unity_connection to a higher version than 14su1,and avoid the version (,14su1)