CVE-2017-3836: Infoleak

Published Feb 22, 2017

Updated

A vulnerability in the web framework Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data. More Information: CSCvb61689. Known Affected Releases: 11.5(1.11007.2). Known Fixed Releases: 12.0(0.98000.162) 12.0(0.98000.178) 12.0(0.98000.383) 12.0(0.98000.488) 12.0(0.98000.536) 12.0(0.98000.6) 12.0(0.98500.6).

Affected Software

1 affected component

Cisco Unified Communications Manager=11.5\(1.11007.2\)

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Cisco Unified Communications Manager web framework to a version that resolves this vulnerability.
Fixed in 12.0(0.98000.162)
Upgrade
Upgrade Cisco Unified Communications Manager web framework to a version that resolves this vulnerability.
Fixed in 12.0(0.98000.178)
Upgrade
Upgrade Cisco Unified Communications Manager web framework to a version that resolves this vulnerability.
Fixed in 12.0(0.98000.383)
Upgrade
Upgrade Cisco Unified Communications Manager web framework to a version that resolves this vulnerability.
Fixed in 12.0(0.98000.488)
Upgrade
Upgrade Cisco Unified Communications Manager web framework to a version that resolves this vulnerability.
Fixed in 12.0(0.98000.536)
Upgrade
Upgrade Cisco Unified Communications Manager web framework to a version that resolves this vulnerability.
Fixed in 12.0(0.98000.6)
Upgrade
Upgrade Cisco Unified Communications Manager web framework to a version that resolves this vulnerability.
Fixed in 12.0(0.98500.6)

Event History

Feb 22, 2017

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

DescriptionWeakness

Data Sourced

via NVD·02:59 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3836?

CVE-2017-3836 is classified as a high severity vulnerability due to its potential for data exposure.

How do I fix CVE-2017-3836?

To mitigate CVE-2017-3836, upgrade to a fixed release such as 12.0(0.98000.162) or later.

Who is affected by CVE-2017-3836?

CVE-2017-3836 affects users of Cisco Unified Communications Manager version 11.5(1.11007.2).

Can I exploit CVE-2017-3836 remotely?

Yes, an unauthenticated remote attacker can exploit CVE-2017-3836 to view sensitive data.

What does CVE-2017-3836 affect?

CVE-2017-3836 affects the web framework of Cisco Unified Communications Manager.