PT-2017-17296 · Cisco · Cisco Unified Communications Manager

Publicado 2017-08-07 · Atualizado 2019-10-09 · CVE-2017-6757

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions 10.5(2.10000.5) through 11.5(1.10000.6)

Description A vulnerability could allow an authenticated, remote attacker to conduct a blind SQL injection attack due to a failure to validate user-supplied input used in SQL queries that bypass protection filters. An attacker could exploit this by sending crafted URLs that include SQL statements, potentially modifying or deleting entries in some database tables and affecting data integrity.

Recommendations For versions 10.5(2.10000.5), 11.0(1.10000.10), and 11.5(1.10000.6), update to a fixed version to prevent blind SQL injection attacks. As a temporary workaround, consider restricting access to SQL queries and validating user-supplied input to minimize the risk of exploitation.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-6757

Produtos afetados

Cisco Unified Communications Manager

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-6757 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-ucm · Aviso do Fabricante
• https://quickview.cloudapps.cisco.com/quickview/bug/CSCve13786 · Aviso do Fabricante
• http://securityfocus.com/bid/100121 · Nota
• http://securitytracker.com/id/1039063 · Nota
• https://osv.dev/vulnerability/CVE-2017-6757 · Aviso do Fabricante