Wednesday, April 24, 2024

Cisco Unified CM SQL Injection Flaw Let Attackers Execute Crafted SQL Queries

Cisco released fixes for Unified Communications Manager (CM) and Unified Communications Manager Session Management Edition to address high-severity SQL injection vulnerability.

“An attacker could exploit this vulnerability by authenticating to the application as a low-privileged user and sending crafted SQL queries to an affected system”, Cisco reports.

“A successful exploit could allow the attacker to read or modify any data on the underlying database or elevate their privileges”.

Cisco Unified CM and Unified CM SME, which are intended as enterprise call and session management systems, guarantee the compatibility of apps like Webex, Jabber, and more while upholding availability and security.

The vulnerability is tracked as CVE-2023-20010 (CVSS score of 8.1). It arises because user input in the web-based management interface of the platforms is not properly validated.

The flaw enables a remote, authenticated attacker to attack a system that is vulnerable to a SQL injection attack.

Vulnerable Products

  • Unified CM
  • Unified CM SME

Products Verified As Not Vulnerable

  • Emergency Responder
  • Finesse
  • Hosted Collaboration Mediation Fulfillment (HCM-F)
  • Packaged Contact Center Enterprise (Packaged CCE)
  • Prime Collaboration Deployment
  • Prime License Manager (PLM)
  • SocialMiner
  • Unified Communications Manager IM & Presence Service (Unified CM IM&P)
  • Unified Contact Center Domain Manager (Unified CCDM)
  • Unified Contact Center Express (Unified CCX)
  • Unified Contact Center Management Portal (Unified CCMP)
  • Unified Intelligence Center
  • Unity Connection

Cisco mentions that there are no workarounds for this vulnerability.

Software Patches

The security flaw impacts Cisco Unified CM and Unified CM SME versions 11.5(1), 12.5(1), and 14, and was fixed in version 12.5(1)SU7 of the applications. A patch will also be included in version 14SU3, which is expected in March 2023.

Hence, customers are encouraged to update to a relevant fixed software release.

Network Security Checklist – Download Free E-Book

Website

Latest articles

Researchers Uncover that UK.GOV Websites Sending Data to Chinese Ad Vendor Analysts

Analysts from Silent Push, a data analytics firm, have uncovered several UK government websites...

Ransomware Victims Who Opt To Pay Ransom Hits Record Low

Law enforcement operations disrupted BlackCat and LockBit RaaS operations, including sanctions on LockBit members...

IBM Nearing Talks to Acquire Cloud-software Provider HashiCorp

IBM is reportedly close to finalizing negotiations to acquire HashiCorp, a prominent cloud infrastructure...

Rewards Up to $10 Million for Information on Iranian Hackers

The United States Justice Department has announced big rewards for information leading to the...

PoC Exploit Released For Critical Oracle VirtualBox Vulnerability

Oracle Virtualbox was identified and reported as having a critical vulnerability associated with Privilege...

Tracing the Steps of Cyber Intruders: The Path of Lateral Movement

When cyber attacks strike, it's rarely a single computer that suffers. Nowadays, cybercriminals set...

U.S. to Impose Visa Restrictions on 13 Individuals Involved in Commercial Spyware Operations

To combat the misuse of commercial spyware, the United States Department of State has...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

WAAP/WAF ROI Analysis

Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles