CVE-2023-20211: SQL Injection
First published: Wed Aug 16 2023(Updated: )
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by authenticating to the application as a user with read-only or higher privileges and sending crafted HTTP requests to an affected system. A successful exploit could allow the attacker to read or modify data in the underlying database or elevate their privileges.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unified Communications Manager | >=12.5\(1\)<12.5\(1\)sub | |
| Cisco Unified Communications Manager | >=12.5\(1\)<12.5\(1\)sub | |
| Cisco Unified Communications Manager | =14.0 | |
| Cisco Unified Communications Manager | =14.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2023-20211.
What is the severity of CVE-2023-20211?
The severity of CVE-2023-20211 is high.
What is the affected software of CVE-2023-20211?
The affected software of CVE-2023-20211 is Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) versions 12.5(1) to 14.0.
What is the description of CVE-2023-20211?
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system.
How can I fix CVE-2023-20211?
Update to a fixed version of Cisco Unified Communications Manager (Unified CM) or Cisco Unified Communications Manager Session Management Edition (Unified CM SME). Ensure proper authentication and authorization controls are in place.
- collector/nvd-index
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/cisco
- canonical/cisco unified communications manager
- version/cisco unified communications manager/12.5\(1\)
- version/cisco unified communications manager/14.0