PT-2022-3512 · Cisco · Cisco Unified Communications Manager+2

Published 2022-07-06 · Updated 2022-07-14 · CVE-2022-20752

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions (affected versions not specified) Cisco Unified Communications Manager Session Management Edition versions (affected versions not specified) Cisco Unity Connection versions (affected versions not specified)

Description A vulnerability in the system could allow an unauthenticated, remote attacker to perform a timing attack due to insufficient protection of a system password. An attacker could exploit this vulnerability by observing the time it takes the system to respond to various queries, potentially determining a sensitive system password.

Recommendations For Cisco Unified Communications Manager, consider temporarily restricting access to sensitive system passwords until a patch is available. For Cisco Unified Communications Manager Session Management Edition, restrict access to system queries to minimize the risk of exploitation. For Cisco Unity Connection, avoid using sensitive system passwords in queries until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-208

Related Identifiers

BDU:2022-04293

CVE-2022-20752

Affected Products

Cisco Unified Communications Manager

Cisco Unified Communications Manager Session Management Edition

Cisco Unity Connection

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucm-timing-JVbHECOK · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20752 · Security Note
• https://bdu.fstec.ru/vul/2022-04293 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20752 · Vendor Advisory
• https://t.me/cibsecurity/45703 · Telegram Post