CVE-2022-20786
Published Apr 21, 2022
Last updated a year ago
Overview
- Description
- A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to improper validation of user-submitted parameters. An attacker could exploit this vulnerability by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain data or modify data that is stored in the underlying database of the affected system.
- Source
- ykramarz@cisco.com
- NVD status
- Modified
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 8.1
- Impact score
- 5.2
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 5.5
- Impact score
- 4.9
- Exploitability score
- 8
- Vector string
- AV:N/AC:L/Au:S/C:P/I:P/A:N
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "12A3E282-8E16-4BEA-BEB6-99630CCAEB3A",
"versionEndExcluding": "11.5\\(1\\)su11",
"versionStartIncluding": "11.5\\(1\\)"
},
{
"criteria": "cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2A2B6AA9-7E2D-4CBB-AFDB-6D5B52AFAB1C",
"versionEndExcluding": "12.5\\(1\\)su6",
"versionStartIncluding": "12.5\\(1\\)"
},
{
"criteria": "cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A14086A0-401F-44AC-B3A6-F20C149C8CC0",
"versionEndExcluding": "14.0su1",
"versionStartIncluding": "14.0"
}
],
"operator": "OR"
}
]
}
]