Information disclosure in Unified Communications Manager (CallManager) - CVE-2019-15963
Published: January 24, 2020
Vulnerability identifier: #VU24527
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-15963
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to insufficient protection of user-supplied input by the web-based management interface of the affected service. A remote authenticated attacker can access the interface, view restricted portions of the software configuration and gain unauthorized access to sensitive information on the system.
Affected software
Unified Communications Manager (CallManager)
How to mitigate CVE-2019-15963
Install updates from vendor's website.
Unified Communications Manager (CallManager) - update to 11.5.1.1 .SU7