Monday, December 4, 2023

Cisco Unified CM SQL Injection Flaw Let Attackers Execute Crafted SQL Queries

Cisco released fixes for Unified Communications Manager (CM) and Unified Communications Manager Session Management Edition to address high-severity SQL injection vulnerability.

“An attacker could exploit this vulnerability by authenticating to the application as a low-privileged user and sending crafted SQL queries to an affected system”, Cisco reports.

“A successful exploit could allow the attacker to read or modify any data on the underlying database or elevate their privileges”.

Cisco Unified CM and Unified CM SME, which are intended as enterprise call and session management systems, guarantee the compatibility of apps like Webex, Jabber, and more while upholding availability and security.

The vulnerability is tracked as CVE-2023-20010 (CVSS score of 8.1). It arises because user input in the web-based management interface of the platforms is not properly validated.

The flaw enables a remote, authenticated attacker to attack a system that is vulnerable to a SQL injection attack.

Vulnerable Products

  • Unified CM
  • Unified CM SME

Products Verified As Not Vulnerable

  • Emergency Responder
  • Finesse
  • Hosted Collaboration Mediation Fulfillment (HCM-F)
  • Packaged Contact Center Enterprise (Packaged CCE)
  • Prime Collaboration Deployment
  • Prime License Manager (PLM)
  • SocialMiner
  • Unified Communications Manager IM & Presence Service (Unified CM IM&P)
  • Unified Contact Center Domain Manager (Unified CCDM)
  • Unified Contact Center Express (Unified CCX)
  • Unified Contact Center Management Portal (Unified CCMP)
  • Unified Intelligence Center
  • Unity Connection

Cisco mentions that there are no workarounds for this vulnerability.

Software Patches

The security flaw impacts Cisco Unified CM and Unified CM SME versions 11.5(1), 12.5(1), and 14, and was fixed in version 12.5(1)SU7 of the applications. A patch will also be included in version 14SU3, which is expected in March 2023.

Hence, customers are encouraged to update to a relevant fixed software release.

Network Security Checklist – Download Free E-Book

Website

Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Booking.com Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles