CVE-2017-12302: SQL Injection
First published: Thu Nov 16 2017(Updated: )
A vulnerability in the Cisco Unified Communications Manager SQL database interface could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. The vulnerability is due to a lack of input validation on user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected system. An exploit could allow the attacker to determine the presence of certain values in the database. Cisco Bug IDs: CSCvf36682.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unified Communications Domain Manager | =10.5\(2.10000.5\) | |
| Cisco Unified Communications Domain Manager | =11.0\(1.10000.10\) | |
| Cisco Unified Communications Domain Manager | =11.5\(1.10000.6\) | |
| Cisco Unified Communications Domain Manager | =12.0\(1.10000.10\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2017-12302?
CVE-2017-12302 is a vulnerability in the Cisco Unified Communications Manager SQL database interface that allows an authenticated, remote attacker to execute arbitrary SQL queries, impacting the system's confidentiality.
How does CVE-2017-12302 affect Cisco Unified Communications Domain Manager?
CVE-2017-12302 affects Cisco Unified Communications Domain Manager versions 10.5(2.10000.5), 11.0(1.10000.10), 11.5(1.10000.6), and 12.0(1.10000.10).
What is the severity of CVE-2017-12302?
CVE-2017-12302 has a severity level of 4.3 (Medium).
How can an attacker exploit CVE-2017-12302?
An attacker can exploit CVE-2017-12302 by sending malicious SQL queries to the Cisco Unified Communications Manager SQL database interface.
Are there any references for CVE-2017-12302?
Yes, you can find references for CVE-2017-12302 at the following links: [Link 1](http://www.securityfocus.com/bid/101853), [Link 2](http://www.securitytracker.com/id/1039826), [Link 3](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-ucm).
- collector/nvd-index
- agent/severity
- agent/author
- agent/references
- agent/weakness
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/cisco
- canonical/cisco unified communications domain manager
- version/cisco unified communications domain manager/10.5\(2.10000.5\)
- version/cisco unified communications domain manager/11.0\(1.10000.10\)
- version/cisco unified communications domain manager/11.5\(1.10000.6\)
- version/cisco unified communications domain manager/12.0\(1.10000.10\)