First published: Fri Aug 31 2007(Updated: )
Multiple SQL injection vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before 4.3(1)sr1 allow remote attackers to execute arbitrary SQL commands via the lang variable to the (1) user or (2) admin logon page, aka CSCsi64265.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Cisco CallManager Express | =4.2\(2\) | |
Cisco Unified Communications Manager Session Management Edition | =3.3\(5\) | |
Cisco CallManager Express | =3.3\(5\)sr2 | |
Cisco CallManager Express | =4.3\(1\) | |
Cisco Unified Communications Manager Session Management Edition | =4.1\(3\)sr1 | |
Cisco CallManager Express | =4.1\(3\)sr1 | |
Cisco CallManager Express | =4.1 | |
Cisco CallManager Express | =3.3\(5\)sr2a | |
Cisco Unified Communications Manager Session Management Edition | =4.2.3sr1 | |
Cisco Unified Communications Manager Session Management Edition | =4.1\(3\)sr2 | |
Cisco CallManager Express | =4.1\(3\)sr2 | |
Cisco Unified Communications Manager Session Management Edition | =4.1\(3\) | |
Cisco Unified Communications Manager Session Management Edition | =4.2 | |
Cisco Unified Communications Manager Session Management Edition | =4.3 | |
Cisco Unified Communications Manager Session Management Edition | =4.2.3 | |
Cisco Unified Communications Manager Session Management Edition | =4.1\(3\)sr4 | |
Cisco CallManager Express | =4.2 | |
Cisco Unified Communications Manager Session Management Edition | =4.2.1 | |
Cisco CallManager Express | =4.2\(1\) | |
Cisco CallManager Express | =4.3 | |
Cisco CallManager Express | =4.1\(3\)sr3 | |
Cisco Unified Communications Manager Session Management Edition | =3.3\(5\)sr2a | |
Cisco CallManager Express | =4.2\(3\)sr1 | |
Cisco Unified Communications Manager Session Management Edition | =4.2.2 | |
Cisco Unified Communications Manager Session Management Edition | =4.3\(1\) | |
Cisco Unified Communications Manager Session Management Edition | =4.1\(3\)sr3 | |
Cisco CallManager Express | =4.2\(3\) | |
Cisco Unified Communications Manager Session Management Edition | =3.3\(5\)sr1 | |
Cisco CallManager Express | =4.2\(3\)sr2 | |
Cisco CallManager Express | =4.1\(3\)sr4 | |
Cisco CallManager Express | =3.3\(5\)sr1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2007-4634 has been classified as a critical vulnerability due to its potential for remote exploitation.
To fix CVE-2007-4634, upgrade Cisco CallManager and Unified Communications Manager to the recommended version as per the vendor's advisory.
CVE-2007-4634 affects several versions of Cisco CallManager and Unified Communications Manager, specifically versions prior to 3.3(5)sr2b, 4.1(3)sr5, 4.2(3)sr2, and 4.3(1)sr1.
CVE-2007-4634 allows remote attackers to execute arbitrary SQL commands.
CVE-2007-4634 was published on August 14, 2007.