CVE-2017-6757: SQL Injection
First published: Mon Aug 07 2017(Updated: )
A vulnerability in Cisco Unified Communications Manager 10.5(2.10000.5), 11.0(1.10000.10), and 11.5(1.10000.6) could allow an authenticated, remote attacker to conduct a blind SQL injection attack. The vulnerability is due to a failure to validate user-supplied input used in SQL queries that bypass protection filters. An attacker could exploit this vulnerability by sending crafted URLs that include SQL statements. An exploit could allow the attacker to modify or delete entries in some database tables, affecting the integrity of the data. Cisco Bug IDs: CSCve13786.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unified Communications Manager Session Management Edition | =10.5\(2.10000.5\) | |
| Cisco Unified Communications Manager Session Management Edition | =11.0\(1.10000.10\) | |
| Cisco Unified Communications Manager Session Management Edition | =11.5\(1.10000.6\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-6757?
CVE-2017-6757 has been classified as a high severity vulnerability due to the potential for remote attackers to perform SQL injection attacks.
How do I fix CVE-2017-6757?
To remediate CVE-2017-6757, it is recommended to update the Cisco Unified Communications Manager to a patched version as specified in Cisco's security advisory.
What systems are affected by CVE-2017-6757?
CVE-2017-6757 affects Cisco Unified Communications Manager versions 10.5(2.10000.5), 11.0(1.10000.10), and 11.5(1.10000.6).
Can CVE-2017-6757 be exploited remotely?
Yes, CVE-2017-6757 can be exploited remotely by an authenticated attacker conducting a blind SQL injection attack.
What are the potential impacts of CVE-2017-6757?
The impacts of CVE-2017-6757 could include unauthorized access to data and the ability to execute arbitrary SQL queries on the database.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco unified communications manager session management edition
- version/cisco unified communications manager session management edition/10.5\(2.10000.5\)
- version/cisco unified communications manager session management edition/11.0\(1.10000.10\)
- version/cisco unified communications manager session management edition/11.5\(1.10000.6\)