Main Vulnerability Database Vulnerabilities #VU71331

SQL injection in Cisco Unified Communications Manager Session Management Edition and Cisco Unified Communications Manager - CVE-2023-20010

Published: January 18, 2023

Vulnerability identifier: #VU71331

CSH Severity: Medium

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-20010

CWE-ID: CWE-89

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the web-based management interface. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Affected software

Cisco Unified Communications Manager Session Management Edition
Cisco Unified Communications Manager

How to mitigate CVE-2023-20010

Install updates from vendor's website.

Cisco Unified Communications Manager Session Management Edition - update to 12.5(1)SU7
Cisco Unified Communications Manager - update to 12.5(1)SU7

External References

Related Security Bulletins