Main Vulnerability Database Vulnerabilities #VU51967

Improper access control in Unified Communications Manager (CallManager) and Cisco Unified Communications Manager Session Management Edition - CVE-2021-1399

Published: April 7, 2021

Vulnerability identifier: #VU51967

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-1399

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the Self Care Portal. A remote authenticated user can bypass implemented security restrictions and modify data on an affected system without proper authorization.

Affected software

Unified Communications Manager (CallManager)
Cisco Unified Communications Manager Session Management Edition

How to mitigate CVE-2021-1399

Install updates from vendor's website.

Unified Communications Manager (CallManager) - update to 12.5.1 SU4
Cisco Unified Communications Manager Session Management Edition - update to 12.5.1 SU4

External References

Related Security Bulletins