Lucene search

[email protected]NVD:CVE-2017-12302

HistoryNov 16, 2017 - 7:29 a.m.

CVE-2017-12302

2017-11-1607:29:00

CWE-89

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

32.1%

JSON

A vulnerability in the Cisco Unified Communications Manager SQL database interface could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. The vulnerability is due to a lack of input validation on user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected system. An exploit could allow the attacker to determine the presence of certain values in the database. Cisco Bug IDs: CSCvf36682.

Affected configurations

Nvd

Node

ciscounified_communications_domain_managerMatch10.5\(2.10000.5\)

ciscounified_communications_domain_managerMatch11.0\(1.10000.10\)

ciscounified_communications_domain_managerMatch11.5\(1.10000.6\)

ciscounified_communications_domain_managerMatch12.0\(1.10000.10\)

VendorProductVersionCPE
ciscounified_communications_domain_manager10.5(2.10000.5)cpe:2.3:a:cisco:unified_communications_domain_manager:10.5\(2.10000.5\):*:*:*:*:*:*:*
ciscounified_communications_domain_manager11.0(1.10000.10)cpe:2.3:a:cisco:unified_communications_domain_manager:11.0\(1.10000.10\):*:*:*:*:*:*:*
ciscounified_communications_domain_manager11.5(1.10000.6)cpe:2.3:a:cisco:unified_communications_domain_manager:11.5\(1.10000.6\):*:*:*:*:*:*:*
ciscounified_communications_domain_manager12.0(1.10000.10)cpe:2.3:a:cisco:unified_communications_domain_manager:12.0\(1.10000.10\):*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	unified_communications_domain_manager	10.5(2.10000.5)	cpe:2.3:a:cisco:unified_communications_domain_manager:10.5\(2.10000.5\):::::::*
cisco	unified_communications_domain_manager	11.0(1.10000.10)	cpe:2.3:a:cisco:unified_communications_domain_manager:11.0\(1.10000.10\):::::::*
cisco	unified_communications_domain_manager	11.5(1.10000.6)	cpe:2.3:a:cisco:unified_communications_domain_manager:11.5\(1.10000.6\):::::::*
cisco	unified_communications_domain_manager	12.0(1.10000.10)	cpe:2.3:a:cisco:unified_communications_domain_manager:12.0\(1.10000.10\):::::::*

References

www.securityfocus.com/bid/101853

www.securitytracker.com/id/1039826

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-ucm

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

32.1%

JSON

Related for NVD:CVE-2017-12302

cvelist1 cve1 prion1 cisco1 nessus1