CVE-2015-6299: SQL Injection

Published Sep 20, 2015

Updated

SQL injection vulnerability in the web interface in Cisco Unity Connection 9.1(1.2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted POST request, aka Bug ID CSCuv63824.

Affected Software

2 affected components

Cisco Unity Connection=9.1\(1\)

Cisco Unity Connection=9.1\(2\)

Event History

Sep 20, 2015

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-6299?

CVE-2015-6299 is classified as a high severity vulnerability due to its potential to allow authenticated users to execute arbitrary SQL commands.

How do I fix CVE-2015-6299?

To fix CVE-2015-6299, upgrade to Cisco Unity Connection version 9.1(3) or later, which addresses this vulnerability.

Who is affected by CVE-2015-6299?

CVE-2015-6299 affects users of Cisco Unity Connection versions 9.1(1) and 9.1(2) who have authenticated access to the web interface.

What type of attack is related to CVE-2015-6299?

CVE-2015-6299 is related to SQL injection attacks that exploit the vulnerability in the web interface to execute unauthorized SQL commands.

Can CVE-2015-6299 be exploited remotely?

Yes, CVE-2015-6299 can be exploited remotely by authenticated users through specially crafted POST requests.