Lucene search

[email protected]CVE-2022-20752

HistoryJul 06, 2022 - 9:15 p.m.

CVE-2022-20752

2022-07-0621:15:11

CWE-208

CWE-203

[email protected]

web.nvd.nist.gov

cve-2022-20752

cisco

unified communications manager

unified cm

sme

unity connection

vulnerability

timing attack

nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.5%

JSON

A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an unauthenticated, remote attacker to perform a timing attack. This vulnerability is due to insufficient protection of a system password. An attacker could exploit this vulnerability by observing the time it takes the system to respond to various queries. A successful exploit could allow the attacker to determine a sensitive system password.

Affected configurations

NVD

Node

ciscounified_communications_managerRange12.5\(1\)–12.5\(1\)su6-

ciscounified_communications_managerRange12.5\(1\)–12.5\(1\)su6session_management

ciscounified_communications_managerRange14.0–14su1-

ciscounified_communications_managerRange14.0–14su1session_management

ciscounity_connectionRange12.5\(1\)–12.5\(1\)su6

ciscounity_connectionRange14.0–14su1

CPENameOperatorVersion
cisco:unified_communications_managercisco unified communications managerlt12.5\(1\)su6
cisco:unified_communications_managercisco unified communications managerlt14su1
cisco:unity_connectioncisco unity connectionlt12.5\(1\)su6
cisco:unity_connectioncisco unity connectionlt14su1

CPE	Name	Operator	Version
cisco:unified_communications_manager	cisco unified communications manager	lt	12.5\(1\)su6
cisco:unified_communications_manager	cisco unified communications manager	lt	14su1
cisco:unity_connection	cisco unity connection	lt	12.5\(1\)su6
cisco:unity_connection	cisco unity connection	lt	14su1

CNA Affected

[
  {
    "product": "Cisco Unified Communications Manager ",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucm-timing-JVbHECOK

Social References

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.5%

JSON

Related for CVE-2022-20752

nessus2 nvd1 cisco1 prion1 cvelist1