CISCO-SA-CUCM-INJECTION-G6MBWH2

CISCO-SA-CUCM-INJECTION-G6MBWH2 PUBLISHED CVSS 8.100000381469727 HIGH

Record from circl · Published August 16, 2023

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by authenticating to the application as a user with read-only or higher privileges and sending crafted HTTP requests to an affected system. A successful exploit could allow the attacker to read or modify data in the underlying database or elevate their privileges. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Risk scores

CVSS 3.1

8.100000381469727

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

Vendor	Product	Versions
	Cisco Unified Communications Manager
	Cisco Unified Communications Manager / Cisco Unity Connection

Timeline

Aug 16, 2023 CVE Published

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CISCO-SA-CUCM-INJECTION-G6MBWH2
vulnetix vdb fixes CISCO-SA-CUCM-INJECTION-G6MBWH2

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CISCO-SA-CUCM-INJECTION-G6MBWH2/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →