CVE-2022-20787: Cisco Unified Communications Products Cross-Site Request Forgery Vulnerability
First published: Thu Apr 21 2022(Updated: )
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edition (SME) Software could allow an authenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unified Communications Manager | >=12.5\(1\)<12.5\(1\)su6 | |
| Cisco Unified Communications Manager | >=12.5\(1\)<12.5\(1\)su6 | |
| Cisco Unified Communications Manager | >=14.0<14su1 | |
| Cisco Unified Communications Manager | >=14.0<14su1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this Cisco Unified Communications Manager vulnerability?
The vulnerability ID is CVE-2022-20787.
What is the severity of CVE-2022-20787?
The severity of CVE-2022-20787 is medium (6.8).
How does CVE-2022-20787 affect Cisco Unified Communications Manager?
CVE-2022-20787 affects the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edition (SME) Software.
What is the impact of CVE-2022-20787?
The impact of CVE-2022-20787 is that an authenticated, remote attacker could conduct a cross-site request forgery (CSRF) attack on an affected device.
How can I fix CVE-2022-20787?
To fix CVE-2022-20787, Cisco has released software updates. Please refer to the Cisco Security Advisory for more information.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/severity
- agent/title
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/cisco
- canonical/cisco unified communications manager
- version/cisco unified communications manager/12.5\(1\)
- version/cisco unified communications manager/14.0