PT-2022-3511 · Cisco · Cisco Unified Communications Manager Im & Presence Service+2
Dan Marin
·
Published
2022-07-06
·
Updated
2022-07-14
·
CVE-2022-20791
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Cisco Unified Communications Manager versions (affected versions not specified)
Cisco Unified Communications Manager Session Management Edition versions (affected versions not specified)
Cisco Unified Communications Manager IM & Presence Service versions (affected versions not specified)
Description
The issue exists due to insufficient file permission restrictions, allowing an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. An attacker could exploit this by sending a crafted command from the API to the application. The attacker would need valid user credentials to exploit this issue.
Recommendations
For Cisco Unified Communications Manager, restrict access to the database user privileges until a patch is available.
For Cisco Unified Communications Manager Session Management Edition, consider disabling the API access to minimize the risk of exploitation.
For Cisco Unified Communications Manager IM & Presence Service, avoid using the affected database user privileges in the API endpoint until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this issue.
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cisco Unified Communications Manager
Cisco Unified Communications Manager Im & Presence Service
Cisco Unified Communications Manager Session Management Edition