SQL injection in Unified Communications Manager (CallManager) and Cisco Unified Communications Manager Session Management Edition - CVE-2021-1282
Published: January 20, 2021 / Updated: January 25, 2021
Vulnerability identifier: #VU49963
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-1282
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data in the web-based management interface. A remote administrator can send a specially crafted request to the affected application and obtain data that is stored in the underlying database.
Affected software
Unified Communications Manager (CallManager)
Cisco Unified Communications Manager Session Management Edition
Cisco Unified Communications Manager Session Management Edition
How to mitigate CVE-2021-1282
Install update from vendor's website.
Unified Communications Manager (CallManager) - addressed in versions 11.5.1 SU9, 12.0.1 SU4, 12.5.1 SU4
Cisco Unified Communications Manager Session Management Edition - addressed in versions 11.5.1 SU9, 12.0.1 SU4, 12.5.1 SU4
Cisco Unified Communications Manager Session Management Edition - addressed in versions 11.5.1 SU9, 12.0.1 SU4, 12.5.1 SU4