SQL Injection Vulnerability in Cisco Unified Communications Manager
CVE-2016-1308

6.5MEDIUM

Key Information:

Vendor
Samsung
Status
X14j Firmware
Vendor
CVE Published:
7 February 2016

Summary

The security flaw identified in Cisco Unified Communications Manager (version 10.5(2.13900.9)) enables remote authenticated users to exploit a SQL injection vulnerability. By crafting specific URLs, an attacker can execute arbitrary SQL commands, potentially compromising the integrity and confidentiality of database information. It is crucial for organizations using this product to implement the necessary security patches and updates as recommended by Cisco to mitigate such vulnerabilities.

References

http://tools.cisco.com/security/center/content/CiscoSecur...
vendor-advisoryx_refsource_CISCO
http://www.securitytracker.com/id/1034938
vdb-entryx_refsource_SECTRACK

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.