Privilege Escalation Vulnerability in Cisco CallManager by Cisco

CVE-2006-0367

Summary

A vulnerability exists in Cisco CallManager that enables remote authenticated users with read-only administrative privileges to escalate their access to full administrative privileges. This is achieved through a specially crafted URL on the CCMAdmin web page, which can be exploited to bypass standard authentication controls. This flaw affects multiple versions of Cisco CallManager, including versions 3.2 and earlier, 3.3 before 3.3(5)SR1, 4.0 before 4.0(2a)SR2c, and 4.1 before 4.1(3)SR2, putting systems at risk of unauthorized access and control.

References