PT-2011-3253 · Apache+1 · Apache Http Server+1

Ven Taute · Publicado 2011-04-28 · Atualizado 2018-10-09 · CVE-2011-1610

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions 6.x through 6.1(5)su2, 7.x through 7.1(5)su3, 8.0 through 8.0(3a)su1, and 8.5 through 8.5(0)su0

Description The issue allows remote attackers to execute arbitrary SQL commands via the f, l, or n parameter in the xmldirectorylist.jsp file of the embedded Apache HTTP Server component.

Recommendations For versions 6.x through 6.1(5)su2, update to version 6.1(5)su3 or later. For versions 7.x through 7.1(5)su3, update to version 7.1(5)su4 or later. For versions 8.0 through 8.0(3a)su1, update to version 8.0(3a)su2 or later. For versions 8.5 through 8.5(0)su0, update to version 8.5(1)su1 or later.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2011-1610

ZDI-11-143

Produtos afetados

Apache Http Server

Cisco Unified Communications Manager

Referências · 11

• http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0051.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67126 · Nota
• http://secunia.com/advisories/44331 · Nota
• http://securityfocus.com/bid/47607 · Nota
• http://cisco.com/en/US/products/products_security_advisory09186a0080b79904.shtml · Aviso do Fabricante
• http://vupen.com/english/advisories/2011/1122 · Nota
• http://securitytracker.com/id?1025449 · Nota
• https://zerodayinitiative.com/advisories/ZDI-11-143 · Nota de Segurança
• http://securityfocus.com/archive/1/517727/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1610 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-11-143 · Nota