PT-2021-1832 · Cisco · Cisco Unified Communications Manager Im & Presence Service+2

Mostafa Soliman · Published 2021-01-20 · Updated 2022-08-05 · CVE-2021-1282

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) (affected versions not specified) Cisco Unified Communications Manager (Unified CM) (affected versions not specified) Cisco Unified Communications Manager Session Management Edition (Unified CM SME) (affected versions not specified)

Description The issue is related to multiple vulnerabilities that could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities affects not only Cisco Unified Communications Manager IM & Presence Service but also Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition. This could enable an attacker to conduct SQL injection attacks. The vulnerability is also related to incorrect restriction of directory path names in the web interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager SME, which may allow a remote attacker to gain unauthorized access to protected information.

Recommendations For Cisco Unified Communications Manager IM & Presence Service, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Cisco Unified Communications Manager, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Cisco Unified Communications Manager Session Management Edition, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

CWE-35

Related Identifiers

BDU:2021-00590

CVE-2021-1282

Affected Products

Cisco Unified Communications Manager

Cisco Unified Communications Manager Im & Presence Service

Cisco Unified Communications Manager Session Management Edition

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imp-trav-inj-dM687ZD6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1282 · Security Note
• https://bdu.fstec.ru/vul/2021-00590 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1282 · Vendor Advisory