CVE-2017-3886: SQL Injection

Published Apr 7, 2017

Updated

A vulnerability in the Cisco Unified Communications Manager web interface could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. The attacker must be authenticated as an administrative user to execute SQL database queries. More Information: CSCvc74291. Known Affected Releases: 1.0(1.10000.10) 11.5(1.10000.6). Known Fixed Releases: 12.0(0.98000.619) 12.0(0.98000.485) 12.0(0.98000.212) 11.5(1.13035.1) 11.0(1.23900.5) 11.0(1.23900.2) 11.0(1.23067.1) 10.5(2.15900.2).

Affected Software

2 affected components

Cisco Unified Communications Manager=11.0\(1.10000.10\)

Cisco Unified Communications Manager=11.5\(1.10000.6\)

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Cisco Unified Communications Manager to a version that resolves this vulnerability.
Fixed in 12.0(0.98000.619)
Upgrade
Upgrade Cisco Unified Communications Manager to a version that resolves this vulnerability.
Fixed in 12.0(0.98000.485)
Upgrade
Upgrade Cisco Unified Communications Manager to a version that resolves this vulnerability.
Fixed in 12.0(0.98000.212)
Upgrade
Upgrade Cisco Unified Communications Manager to a version that resolves this vulnerability.
Fixed in 11.5(1.13035.1)
Upgrade
Upgrade Cisco Unified Communications Manager to a version that resolves this vulnerability.
Fixed in 11.0(1.23900.5)
Upgrade
Upgrade Cisco Unified Communications Manager to a version that resolves this vulnerability.
Fixed in 11.0(1.23900.2)
Upgrade
Upgrade Cisco Unified Communications Manager to a version that resolves this vulnerability.
Fixed in 11.0(1.23067.1)
Upgrade
Upgrade Cisco Unified Communications Manager to a version that resolves this vulnerability.
Fixed in 10.5(2.15900.2)
Compensating control
Because the attacker must be authenticated as an administrative user to execute SQL database queries, restrict administrative access to the Cisco Unified Communications Manager web interface to trusted administrators only (e.g., limit admin accounts and access paths), and ensure remote administrative access is controlled.

Event History

Apr 7, 2017

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionWeakness

Data Sourced

via NVD·05:59 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3886?

CVE-2017-3886 has a high severity rating due to its potential for SQL Injection vulnerabilities that can affect confidentiality.

How do I fix CVE-2017-3886?

To fix CVE-2017-3886, apply the latest security patches released by Cisco for the affected versions of Unified Communications Manager.

Who is affected by CVE-2017-3886?

CVE-2017-3886 affects users of Cisco Unified Communications Manager versions 11.0(1.10000.10) and 11.5(1.10000.6) that have administrative access.

What impact does CVE-2017-3886 have on affected systems?

CVE-2017-3886 could allow authenticated attackers to execute arbitrary SQL queries, potentially compromising sensitive system information.

Is authentication required to exploit CVE-2017-3886?

Yes, an attacker must be authenticated as an administrative user to exploit CVE-2017-3886.