CVE-2024-20272

Published Jan 17, 2024

Last updated 9 months ago

Overview

Description: A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system and execute commands on the underlying operating system. This vulnerability is due to a lack of authentication in a specific API and improper validation of user-supplied data. An attacker could exploit this vulnerability by uploading arbitrary files to an affected system. A successful exploit could allow the attacker to store malicious files on the system, execute arbitrary commands on the operating system, and elevate privileges to root.
Source: ykramarz@cisco.com
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo
ykramarz@cisco.com: CWE-434

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "05EE3F1E-0C35-4922-BB29-0E48323ED572",
            "versionEndExcluding": "12.5.1.19017-4"
          },
          {
            "criteria": "cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "02BBF889-9F0F-420A-BA31-3DF0C41F6782",
            "versionEndExcluding": "14.0.1.14006-5",
            "versionStartIncluding": "14.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

Weaknesses

Configurations

References