PT-2019-1401 · Cisco · Cisco Unified Communications Manager

Published 2019-01-09 · Updated 2020-08-28 · CVE-2018-0474

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager (affected versions not specified)

Description The issue is related to insufficient protection of saved passwords when loading configuration pages in the web interface of Cisco Unified Communications Manager. This could allow a remote attacker to gain access to sensitive information. The vulnerability is due to the incorrect inclusion of saved passwords in configuration pages, which could be exploited by an authenticated attacker viewing the source code of the configuration page, potentially allowing them to recover passwords and expose accounts to further attacks.

Recommendations For all affected versions, consider restricting access to the web-based management interface until a fix is available. As a temporary workaround, avoid viewing the source code of configuration pages in the Cisco Unified Communications Manager web-based management interface to minimize the risk of password exposure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Information Disclosure

Weakness Enumeration

CWE-522

CWE-200

Related Identifiers

BDU:2019-00782

CVE-2018-0474

Affected Products

Cisco Unified Communications Manager

References · 5

• https://osv.dev/vulnerability/CVE-2018-0474 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0474 · Security Note
• https://bdu.fstec.ru/vul/2019-00782 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-cucm-creds-disclosr · Vendor Advisory
• http://securityfocus.com/bid/106538 · Note