PT-2022-3982 · Cisco · Cisco Unified Communications Manager+1

Cristian Mocanu + 1 · Published 2022-08-03 · Updated 2022-08-12 · CVE-2022-20816

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager (Unified CM) versions (affected versions not specified) Cisco Unified Communications Manager Session Management Edition (Unified CM SME) versions (affected versions not specified)

Description A vulnerability in the web-based management interface of the affected software could allow an authenticated, remote attacker to delete arbitrary files from an affected system. This issue exists because the software does not properly validate HTTP requests, such as those sent to /api endpoints, allowing an attacker to exploit the vulnerability by sending a crafted HTTP request. A successful exploit could allow the attacker to delete arbitrary files from the affected system.

Recommendations For Cisco Unified Communications Manager (Unified CM), at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Cisco Unified Communications Manager Session Management Edition (Unified CM SME), at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2022-04815

CVE-2022-20816

Affected Products

Cisco Unified Communications Manager

Cisco Unified Communications Manager Session Management Edition

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-file-delete-N2VPmOnE · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04815 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20816 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20816 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-file-delete-N2VPmOnE · Note