PT-2017-17296 · Cisco · Cisco Unified Communications Manager

Published 2017-08-07 · Updated 2019-10-09 · CVE-2017-6757

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions 10.5(2.10000.5) through 11.5(1.10000.6)

Description A vulnerability could allow an authenticated, remote attacker to conduct a blind SQL injection attack due to a failure to validate user-supplied input used in SQL queries that bypass protection filters. An attacker could exploit this by sending crafted URLs that include SQL statements, potentially modifying or deleting entries in some database tables and affecting data integrity.

Recommendations For versions 10.5(2.10000.5), 11.0(1.10000.10), and 11.5(1.10000.6), update to a fixed version to prevent blind SQL injection attacks. As a temporary workaround, consider restricting access to SQL queries and validating user-supplied input to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-6757

Affected Products

Cisco Unified Communications Manager

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-6757 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-ucm · Vendor Advisory
• https://quickview.cloudapps.cisco.com/quickview/bug/CSCve13786 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6757 · Vendor Advisory
• http://securityfocus.com/bid/100121 · Note
• http://securitytracker.com/id/1039063 · Note