CVE-2022-20790: Cisco Unified Communications Products Arbitrary File Read Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to read arbitrary files from the underlying operating system. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to access sensitive files on the underlying operating system.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-20790?
CVE-2022-20790 is a vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) that allows an authenticated, remote attacker to read arbitrary files from the underlying operating system.
What is the severity of CVE-2022-20790?
The severity of CVE-2022-20790 is medium, with a severity value of 6.5.
Which software versions are affected by CVE-2022-20790?
Cisco Unified Communications Manager versions up to and inclusive of 14.0 are affected by CVE-2022-20790.
How can an authenticated attacker exploit CVE-2022-20790?
An authenticated attacker can exploit CVE-2022-20790 by accessing the web-based management interface and reading arbitrary files from the underlying operating system.
Is there a fix for CVE-2022-20790?
Yes, Cisco has provided security updates to address the CVE-2022-20790 vulnerability. It is recommended to apply the necessary patches or updates as provided by the vendor.