CVE-2021-1406

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-1406
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper inclusion of sensitive information in downloadable files. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a specific set of commands. A successful exploit could allow the attacker to obtain hashed credentials of system users. To exploit this vulnerability an attacker would need to have valid user credentials with elevated privileges.

4.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-inf-disc-wCxZNjL2 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\):*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\):*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su1:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su1:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su2:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su2:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su2a:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su2a:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su3:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su3:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su3a:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su3a:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su4:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su4:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su4a:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su4a:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su5:*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su6:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su6:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su6a:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su6a:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su7:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su7:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su8:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su8:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su9:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su9:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su10:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su10:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\):*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\):*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su1:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su1:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su2:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su2:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su3:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su3:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su4:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su4:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su5:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su5:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su7:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su7:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su8:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su8:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su9:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su9:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.0\(1\):*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.0\(1\):*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\):*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\):*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\)su1:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\)su1:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\)su2:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\)su2:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\)su3:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\)su3:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\)su4:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\)su4:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\)su5:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\)su5:*:*:*:session_management:*:*:*
History

20 Sep 2022, 17:01

Type Values Removed Values Added
CWE CWE-538 CWE-200

05 Jan 2022, 13:55

Type Values Removed Values Added
CPE cpe:2.3:a:cisco:unified_communications_manager:14.0\(1.10000.20\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1.10000.22\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.0\(1.10000.10\):*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1.10000.22\):*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2.10000.5\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.0\(1.10000.10\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:14.0\(1.10000.20\):*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2.10000.5\):*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1.10000.6\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1.10000.6\):*:*:*:session_management:*:*:*		 cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su4:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\)su5:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su5:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\)su4:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\)su1:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su10:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\)su4:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\):*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su5:*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su2:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su5:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su1:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su7:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su2a:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\)su5:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su8:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\)su2:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\)su1:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su1:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.0\(1\):*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\):*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su3:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su8:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su3:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su8:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\)su2:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\)su3:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su6:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su3:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su4:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su2:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su4a:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su2:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.0\(1\):*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su2:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su3a:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su7:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su3:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\):*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su4a:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su9:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\):*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su1:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su4:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su9:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su4:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su1:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su3a:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\)su3:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su10:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\):*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su6a:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su6a:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su8:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su6:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su7:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su7:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su9:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su2a:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su9:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\):*:*:*:session_management:*:*:*

19 Apr 2021, 20:10

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : 4.0
v3 : 4.9
References (CISCO) https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-inf-disc-wCxZNjL2 - (CISCO) https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-inf-disc-wCxZNjL2 - Vendor Advisory
CPE cpe:2.3:a:cisco:unified_communications_manager:11.5\(1.10000.6\):*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1.10000.6\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.0\(1.10000.10\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1.10000.22\):*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:14.0\(1.10000.20\):*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:14.0\(1.10000.20\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2.10000.5\):*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1.10000.22\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.0\(1.10000.10\):*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2.10000.5\):*:*:*:*:*:*:*

08 Apr 2021, 05:15

Type Values Removed Values Added
Summary A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper inclusion of sensitive information in downloadable files. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a specific set of commands. A successful exploit could allow the attacker to obtain hashed credentials of system users. To exploit this vulnerability an attacker would need to have valid user credentials with elevated privileges. A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper inclusion of sensitive information in downloadable files. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a specific set of commands. A successful exploit could allow the attacker to obtain hashed credentials of system users. To exploit this vulnerability an attacker would need to have valid user credentials with elevated privileges.

08 Apr 2021, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2021-04-08 04:15

Updated : 2023-12-10 13:55

NVD link : CVE-2021-1406

Mitre link : CVE-2021-1406

CVE.ORG link : CVE-2021-1406

JSON object : View

Products Affected

cisco

  • unified_communications_manager
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-538

Insertion of Sensitive Information into Externally-Accessible File or Directory