cisco-sa-cucm-inf-disc-wCxZNjL2: Cisco Unified Communications Manager Information Disclosure Vulnerability
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper inclusion of sensitive information in downloadable files. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a specific set of commands. A successful exploit could allow the attacker to obtain hashed credentials of system users. To exploit this vulnerability an attacker would need to have valid user credentials with elevated privileges. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-inf-disc-wCxZNjL2
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of Cisco-SA-CUCM-INF-DISC-WCxZNjL2?
The severity of Cisco-SA-CUCM-INF-DISC-WCxZNjL2 is classified as high due to its potential impact on sensitive information.
How do I fix Cisco-SA-CUCM-INF-DISC-WCxZNjL2?
To fix Cisco-SA-CUCM-INF-DISC-WCxZNjL2, ensure that your Cisco Unified Communications Manager and Session Management Edition are updated to the latest secure versions recommended by Cisco.
Who is affected by Cisco-SA-CUCM-INF-DISC-WCxZNjL2?
Organizations using Cisco Unified Communications Manager or Cisco Unified Communications Manager Session Management Edition are affected by Cisco-SA-CUCM-INF-DISC-WCxZNjL2.
What type of attack does Cisco-SA-CUCM-INF-DISC-WCxZNjL2 mitigate?
Cisco-SA-CUCM-INF-DISC-WCxZNjL2 mitigates the risk of authenticated remote attacks that could lead to unauthorized access to sensitive information.
What is the cause of Cisco-SA-CUCM-INF-DISC-WCxZNjL2?
The cause of Cisco-SA-CUCM-INF-DISC-WCxZNjL2 is a vulnerability in the software that allows authenticated users to potentially access sensitive information.