SQL Injection Vulnerability in Cisco Unified Communications Manager
CVE-2016-1317

4.3MEDIUM

Key Information:

Vendor

Zyxel
Status
Gs1900-10HP Firmware
Vendor
CVE Published:
9 February 2016

What is CVE-2016-1317?

A vulnerability exists in Cisco Unified Communications Manager, where remote authenticated users can exploit the system to access sensitive database information. By making direct requests to specific URLs, attackers have the potential to obtain critical data such as table names and entity names, leading to unauthorized information disclosure.

References

http://www.securitytracker.com/id/1034957
vdb-entryx_refsource_SECTRACK
http://tools.cisco.com/security/center/content/CiscoSecur...
vendor-advisoryx_refsource_CISCO

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.