PT-2021-7019 · Cisco · Cisco Unified Communications Manager+1

Published 2021-11-02 · Updated 2022-05-03 · CVE-2022-20789

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) (affected versions not specified)

Description A vulnerability in the software upgrade process could allow an authenticated, remote attacker to write arbitrary files on the affected system. This issue is due to improper restrictions applied to a system script. An attacker could exploit this by using crafted variables during the execution of a system upgrade, potentially allowing them to overwrite or append arbitrary data to system files using root-level privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-73

CWE-610

Related Identifiers

BDU:2022-02979

CVE-2022-20789

Affected Products

Cisco Unified Communications Manager

Cisco Unified Communications Manager Session Management Edition

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-20789 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-arb-write-74QzruUU · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20789 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02979 · Security Note
• https://cybersecurity-help.cz/vdb/SB2022042130 · Note
• https://vuldb.com/?id.198306 · Note