A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to improper validation of user-submitted parameters. An attacker could exploit this vulnerability by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain data or modify data that is stored in the underlying database of the affected system.
References
| Link | Resource |
|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imp-sqlinj-GrpUuQEJ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
04 May 2022, 18:13
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CISCO) https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imp-sqlinj-GrpUuQEJ - Vendor Advisory | |
| CWE | CWE-89 | |
| CPE | cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:* | |
| First Time |
Cisco unified Communications Manager Im And Presence Service
Cisco |
|
| CVSS |
v2 : v3 : |
v2 : 5.5
v3 : 8.1 |
21 Apr 2022, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-04-21 19:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-20786
Mitre link : CVE-2022-20786
CVE.ORG link : CVE-2022-20786
JSON object : View
Products Affected
cisco
- unified_communications_manager_im_and_presence_service
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')