CVE-2017-3886: SQL Injection
First published: Fri Apr 07 2017(Updated: )
A vulnerability in the Cisco Unified Communications Manager web interface could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. The attacker must be authenticated as an administrative user to execute SQL database queries. More Information: CSCvc74291. Known Affected Releases: 1.0(1.10000.10) 11.5(1.10000.6). Known Fixed Releases: 12.0(0.98000.619) 12.0(0.98000.485) 12.0(0.98000.212) 11.5(1.13035.1) 11.0(1.23900.5) 11.0(1.23900.2) 11.0(1.23067.1) 10.5(2.15900.2).
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unified Communications Manager | =11.0\(1.10000.10\) | |
| Cisco Unified Communications Manager | =11.5\(1.10000.6\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-3886?
CVE-2017-3886 has a high severity rating due to its potential for SQL Injection vulnerabilities that can affect confidentiality.
How do I fix CVE-2017-3886?
To fix CVE-2017-3886, apply the latest security patches released by Cisco for the affected versions of Unified Communications Manager.
Who is affected by CVE-2017-3886?
CVE-2017-3886 affects users of Cisco Unified Communications Manager versions 11.0(1.10000.10) and 11.5(1.10000.6) that have administrative access.
What impact does CVE-2017-3886 have on affected systems?
CVE-2017-3886 could allow authenticated attackers to execute arbitrary SQL queries, potentially compromising sensitive system information.
Is authentication required to exploit CVE-2017-3886?
Yes, an attacker must be authenticated as an administrative user to exploit CVE-2017-3886.
- agent/references
- agent/author
- agent/severity
- agent/type
- agent/event
- agent/weakness
- agent/description
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco unified communications manager
- version/cisco unified communications manager/11.0\(1.10000.10\)
- version/cisco unified communications manager/11.5\(1.10000.6\)