CVE-2022-20789: Cisco Unified Communications Products Arbitrary File Write Vulnerability
First published: Thu Apr 21 2022(Updated: )
A vulnerability in the software upgrade process of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to write arbitrary files on the affected system. This vulnerability is due to improper restrictions applied to a system script. An attacker could exploit this vulnerability by using crafted variables during the execution of a system upgrade. A successful exploit could allow the attacker to overwrite or append arbitrary data to system files using root-level privileges.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unified Communications Manager | =12.5\(1\) | |
| Cisco Unified Communications Manager | =12.5\(1\) | |
| Cisco Unified Communications Manager | =14.0 | |
| Cisco Unified Communications Manager | =14.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2022-20789.
What is the severity level of CVE-2022-20789?
The severity level of CVE-2022-20789 is high.
How does CVE-2022-20789 affect Cisco Unified Communications Manager (Unified CM)?
CVE-2022-20789 allows an authenticated, remote attacker to write arbitrary files on the affected system.
Which versions of Cisco Unified Communications Manager (Unified CM) are affected by CVE-2022-20789?
Versions 12.5(1) and 14.0 of Cisco Unified Communications Manager (Unified CM) are affected by CVE-2022-20789.
How can I fix CVE-2022-20789?
Cisco has released a security advisory with mitigation details for CVE-2022-20789. Please refer to the advisory at [https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-arb-write-74QzruUU](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-arb-write-74QzruUU) for more information on how to fix this vulnerability.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/title
- agent/last-modified-date
- agent/references
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- vendor/cisco
- canonical/cisco unified communications manager
- version/cisco unified communications manager/12.5\(1\)
- version/cisco unified communications manager/14.0