CVE-2016-6464: Infoleak

Published Dec 14, 2016

Updated

A vulnerability in the web management interface of the Cisco Unified Communications Manager IM and Presence Service could allow an unauthenticated, remote attacker to view information on web pages that should be restricted. More Information: CSCva49629. Known Affected Releases: 11.5(1). Known Fixed Releases: 11.5(1.12000.2) 12.0(0.98000.181).

Affected Software

4 affected components

Cisco Unified Communications Manager IM and Presence Service=10.5\(1\)

Cisco Unified Communications Manager IM and Presence Service=10.5\(2\)

Cisco Unified Communications Manager IM and Presence Service=11.0\(1\)

Cisco Unified Communications Manager IM and Presence Service=11.5\(1\)

Event History

Dec 14, 2016

CVE Published

via MITRE·12:37 AM

Data Sourced

via MITRE·12:37 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2016-6464?

CVE-2016-6464 has been classified as a medium severity vulnerability.

How do I fix CVE-2016-6464?

To fix CVE-2016-6464, upgrade to a fixed version of Cisco Unified Communications Manager IM and Presence Service.

What information can an attacker access through CVE-2016-6464?

An attacker can view restricted information on web pages accessible through the vulnerable web management interface.

Which versions of Cisco Unified Communications Manager IM and Presence Service are affected by CVE-2016-6464?

Affected versions include 10.5(1), 10.5(2), 11.0(1), and 11.5(1).

Is authentication required to exploit CVE-2016-6464?

No, CVE-2016-6464 can be exploited by an unauthenticated remote attacker.