Main Vulnerability Database Vulnerabilities #VU79948

SQL injection in Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition - CVE-2023-20211

Published: August 24, 2023

Vulnerability identifier: #VU79948

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-20211

CWE-ID: CWE-89

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the web-based management interface. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Affected software

Cisco Unified Communications Manager
Cisco Unified Communications Manager Session Management Edition

How to mitigate CVE-2023-20211

Install update from vendor's website.

Cisco Unified Communications Manager - update to 12.5(1)SU8

External References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-injection-g6MbwH2

Related Security Bulletins