CVE-2011-1610: SQL Injection
First published: Tue May 03 2011(Updated: )
Multiple SQL injection vulnerabilities in xmldirectorylist.jsp in the embedded Apache HTTP Server component in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su3, 7.x before 7.1(5)su4, 8.0 before 8.0(3a)su2, and 8.5 before 8.5(1)su1 allow remote attackers to execute arbitrary SQL commands via the (1) f, (2) l, or (3) n parameter, aka Bug ID CSCtj42064.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unified Communications Manager | =6.1\(3a\) | |
| Cisco Unified Communications Manager | =6.1\(2\) | |
| Cisco Unified Communications Manager | =6.1\(3b\)su1 | |
| Cisco Unified Communications Manager | =6.1\(2\)su1a | |
| Cisco Unified Communications Manager | =6.1\(4\)su1 | |
| Cisco Unified Communications Manager | =6.1\(4\) | |
| Cisco Unified Communications Manager | =6.1\(5\)su1 | |
| Cisco Unified Communications Manager | =6.1\(4a\) | |
| Cisco Unified Communications Manager | =6.1\(5\)su2 | |
| Cisco Unified Communications Manager | =6.1\(3\) | |
| Cisco Unified Communications Manager | =6.1\(4a\)su2 | |
| Cisco Unified Communications Manager | =6.1\(1\) | |
| Cisco Unified Communications Manager | =6.1\(1b\) | |
| Cisco Unified Communications Manager | =6.1\(3b\) | |
| Cisco Unified Communications Manager | =6.1\(5\) | |
| Cisco Unified Communications Manager | =6.1\(2\)su1 | |
| Cisco Unified Communications Manager | =6.0 | |
| Cisco Unified Communications Manager | =6.1\(1a\) | |
| Cisco Unified Communications Manager | =7.1\(2b\)su1 | |
| Cisco Unified Communications Manager | =7.1\(2b\) | |
| Cisco Unified Communications Manager | =7.1\(3b\) | |
| Cisco Unified Communications Manager | =7.1\(2a\)su1 | |
| Cisco Unified Communications Manager | =7.1\(3b\)su1 | |
| Cisco Unified Communications Manager | =7.1\(3a\)su1a | |
| Cisco Unified Communications Manager | =7.1\(5b\)su3 | |
| Cisco Unified Communications Manager | =7.1\(3\) | |
| Cisco Unified Communications Manager | =7.1\(2a\) | |
| Cisco Unified Communications Manager | =7.1\(5b\) | |
| Cisco Unified Communications Manager | =7.0\(2a\) | |
| Cisco Unified Communications Manager | =7.0\(1\)su1 | |
| Cisco Unified Communications Manager | =7.0\(1\)su1a | |
| Cisco Unified Communications Manager | =7.1\(5b\)su2 | |
| Cisco Unified Communications Manager | =7.1\(5\) | |
| Cisco Unified Communications Manager | =7.1\(5a\) | |
| Cisco Unified Communications Manager | =7.0\(2a\)su2 | |
| Cisco Unified Communications Manager | =7.1\(5\)su1a | |
| Cisco Unified Communications Manager | =7.1\(5\)su1 | |
| Cisco Unified Communications Manager | =7.1\(3a\) | |
| Cisco Unified Communications Manager | =7.0\(2a\)su1 | |
| Cisco Unified Communications Manager | =7.1\(3a\)su1 | |
| Cisco Unified Communications Manager | =7.0\(2\) | |
| Cisco Unified Communications Manager | =7.1\(3b\)su2 | |
| Cisco Unified Communications Manager | =8.0\(2c\) | |
| Cisco Unified Communications Manager | =8.0 | |
| Cisco Unified Communications Manager | =8.0\(3\) | |
| Cisco Unified Communications Manager | =8.0\(3a\) | |
| Cisco Unified Communications Manager | =8.0\(2c\)su1 | |
| Cisco Unified Communications Manager | =8.0\(3a\)su1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://zerodayinitiative.com/advisories/ZDI-11-143/
- http://www.cisco.com/en/US/products/products_security_advisory09186a0080b79904.shtml
- http://secunia.com/advisories/44331
- http://www.securitytracker.com/id?1025449
- http://www.securityfocus.com/bid/47607
- http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0051.html
- http://www.vupen.com/english/advisories/2011/1122
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67126
- http://www.securityfocus.com/archive/1/517727/100/0/threaded
Frequently Asked Questions
What are the SQL injection vulnerabilities associated with CVE-2011-1610?
CVE-2011-1610 includes multiple SQL injection vulnerabilities in the xmldirectorylist.jsp file of the embedded Apache HTTP Server in various versions of Cisco Unified Communications Manager.
What versions of Cisco Unified Communications Manager are affected by CVE-2011-1610?
The vulnerability affects Cisco Unified Communications Manager versions prior to 6.1(5)su3, 7.1(5)su4, 8.0(3a)su2, and 8.5(1)su1.
How can administrators mitigate the risks of CVE-2011-1610?
Administrators can mitigate CVE-2011-1610 by upgrading Cisco Unified Communications Manager to the latest patched versions.
What impact can CVE-2011-1610 have on affected systems?
Successful exploitation of CVE-2011-1610 can allow remote attackers to execute arbitrary SQL commands on the underlying database, potentially leading to data breach or system compromise.
Is there a public advisory for CVE-2011-1610?
Yes, Cisco has released security advisories that detail the vulnerabilities and the necessary steps for remediation for CVE-2011-1610.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/last-modified-date
- agent/author
- agent/first-publish-date
- agent/event
- agent/description
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/weakness
- agent/tags
- agent/source
- vendor/cisco
- canonical/cisco unified communications manager
- version/cisco unified communications manager/6.1\(3a\)
- version/cisco unified communications manager/6.1\(2\)
- version/cisco unified communications manager/6.1\(3b\)su1
- version/cisco unified communications manager/6.1\(2\)su1a
- version/cisco unified communications manager/6.1\(4\)su1
- version/cisco unified communications manager/6.1\(4\)
- version/cisco unified communications manager/6.1\(5\)su1
- version/cisco unified communications manager/6.1\(4a\)
- version/cisco unified communications manager/6.1\(5\)su2
- version/cisco unified communications manager/6.1\(3\)
- version/cisco unified communications manager/6.1\(4a\)su2
- version/cisco unified communications manager/6.1\(1\)
- version/cisco unified communications manager/6.1\(1b\)
- version/cisco unified communications manager/6.1\(3b\)
- version/cisco unified communications manager/6.1\(5\)
- version/cisco unified communications manager/6.1\(2\)su1
- version/cisco unified communications manager/6.0
- version/cisco unified communications manager/6.1\(1a\)
- version/cisco unified communications manager/7.1\(2b\)su1
- version/cisco unified communications manager/7.1\(2b\)
- version/cisco unified communications manager/7.1\(3b\)
- version/cisco unified communications manager/7.1\(2a\)su1
- version/cisco unified communications manager/7.1\(3b\)su1
- version/cisco unified communications manager/7.1\(3a\)su1a
- version/cisco unified communications manager/7.1\(5b\)su3
- version/cisco unified communications manager/7.1\(3\)
- version/cisco unified communications manager/7.1\(2a\)
- version/cisco unified communications manager/7.1\(5b\)
- version/cisco unified communications manager/7.0\(2a\)
- version/cisco unified communications manager/7.0\(1\)su1
- version/cisco unified communications manager/7.0\(1\)su1a
- version/cisco unified communications manager/7.1\(5b\)su2
- version/cisco unified communications manager/7.1\(5\)
- version/cisco unified communications manager/7.1\(5a\)
- version/cisco unified communications manager/7.0\(2a\)su2
- version/cisco unified communications manager/7.1\(5\)su1a
- version/cisco unified communications manager/7.1\(5\)su1
- version/cisco unified communications manager/7.1\(3a\)
- version/cisco unified communications manager/7.0\(2a\)su1
- version/cisco unified communications manager/7.1\(3a\)su1
- version/cisco unified communications manager/7.0\(2\)
- version/cisco unified communications manager/7.1\(3b\)su2
- version/cisco unified communications manager/8.0\(2c\)
- version/cisco unified communications manager/8.0
- version/cisco unified communications manager/8.0\(3\)
- version/cisco unified communications manager/8.0\(3a\)
- version/cisco unified communications manager/8.0\(2c\)su1
- version/cisco unified communications manager/8.0\(3a\)su1