CVE-2023-20010: SQL Injection
First published: Thu Jan 19 2023(Updated: )
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface inadequately validates user input. An attacker could exploit this vulnerability by authenticating to the application as a low-privileged user and sending crafted SQL queries to an affected system. A successful exploit could allow the attacker to read or modify any data on the underlying database or elevate their privileges.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unified Communications Manager | <12.5\(1\)su7 | |
| Cisco Unified Communications Manager | >=11.5\(1\)<12.5\(1\)su7 | |
| Cisco Unified Communications Manager | >=14.0<14su2 | |
| Cisco Unified Communications Manager | >=14.0<14su2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID is CVE-2023-20010.
What is the severity level of CVE-2023-20010?
The severity level of CVE-2023-20010 is high.
What software is affected by CVE-2023-20010?
Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edit…
What is the impact of CVE-2023-20010?
An authenticated remote attacker could conduct SQL injection attacks on an affected system.
Is there a fix available for CVE-2023-20010?
Yes, Cisco has released a security advisory with fixes and mitigations for this vulnerability.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/author
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/event
- agent/first-publish-date
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/cisco
- canonical/cisco unified communications manager
- version/cisco unified communications manager/11.5\(1\)
- version/cisco unified communications manager/14.0