CVE-2020-3135: Cisco Unified Communications Manager Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (UCM) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the targeted user.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-3135?
CVE-2020-3135 is a vulnerability in the web-based management interface of Cisco Unified Communications Manager (UCM) that allows an unauthenticated attacker to conduct a cross-site request forgery (CSRF) attack.
How severe is CVE-2020-3135?
CVE-2020-3135 has a severity rating of 8.8, which is considered high.
What is the affected software of CVE-2020-3135?
The affected software of CVE-2020-3135 is Cisco Unified Communications Manager version 11.5(1) and earlier.
How can an attacker exploit CVE-2020-3135?
An attacker can exploit CVE-2020-3135 by tricking a user into clicking on a specially crafted link or visiting a malicious website, which would initiate a CSRF attack.
Is there a fix for CVE-2020-3135?
Yes, Cisco has released a security advisory with mitigation measures to address the vulnerability. Please refer to the Cisco Security Advisory for more information.