CVE-2015-4684: Polycom Realpresence Resource Manager

Medium severity, CVSS 6.5. EPSS: 4.9% chance of exploitation in the next 30 days.

Multiple directory traversal vulnerabilities in Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allow (1) remote authenticated users to read arbitrary files via a .. (dot dot) in the Modifier parameter to PlcmRmWeb/FileDownload; or remote authenticated administrators to upload arbitrary files via the (2) Filename or (3) SE_FNAME parameter to PlcmRmWeb/FileUpload or to read and remove arbitrary files via the (4) filePathName parameter in an importSipUriReservations SOAP request to PlcmRmWeb/JUserManager.

Affected products

• Polycom Realpresence Resource Manager: up to and including 8.3.2

Published 2017-09-19. Last modified 2026-06-17.