cisco-sa-ucm-file-read-h8h4HEJ3: Cisco Unified Communications Products Arbitrary File Read Vulnerability
First published: Wed Apr 20 2022(Updated: )
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to read arbitrary files from the underlying operating
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unified CM | <14SU1 | 14SU1 |
| Cisco Unified CM SME | <14SU1 | 14SU1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is cisco-sa-ucm-file-read-h8h4HEJ3.
What is the title of this vulnerability?
The title of this vulnerability is 'Cisco Unified Communications Products Arbitrary File Read Vulnerability'.
What is the severity of cisco-sa-ucm-file-read-h8h4HEJ3?
The severity of cisco-sa-ucm-file-read-h8h4HEJ3 is medium with a severity value of 6.5.
Which software products are affected by cisco-sa-ucm-file-read-h8h4HEJ3?
Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) are affected by cisco-sa-ucm-file-read-h8h4HEJ3.
How can an attacker exploit this vulnerability?
An authenticated, remote attacker can exploit this vulnerability by reading arbitrary files from the underlying operating system through the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME).
What is the Common Weakness Enumeration (CWE) ID for this vulnerability?
The Common Weakness Enumeration (CWE) ID for this vulnerability is 23.
How can I fix cisco-sa-ucm-file-read-h8h4HEJ3?
To fix cisco-sa-ucm-file-read-h8h4HEJ3, update Cisco Unified Communications Manager (Unified CM) to version 14SU1 or later.
Is there any additional reference available for this vulnerability?
Yes, you can refer to the Cisco Security Advisory for more information: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucm-file-read-h8h4HEJ3
- collector/cisco-recent
- agent/severity
- agent/weakness
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- agent/title
- agent/references
- collector/cisco-advisory
- source/Cisco
- agent/software-canonical-lookup
- vendor/cisco
- canonical/cisco unified cm
- canonical/cisco unified cm sme