SQL Injection Vulnerability in Cisco Unified Communications Manager Products
CVE-2023-20211
8.8HIGH
Key Information:
- Vendor
Cisco
- Status
- Vendor
- CVE Published:
- 16 August 2023
What is CVE-2023-20211?
A vulnerability exists in the web-based management interface of Cisco's Unified Communications Manager and Session Management Edition. This flaw arises from inadequate validation of user inputs, allowing an authenticated attacker with read-only or higher privileges to execute SQL injection attacks. By crafting malicious HTTP requests, the attacker could manipulate or retrieve sensitive data from the database, posing significant risks to data integrity and confidentiality.
Affected Version(s)
Cisco Unified Communications Manager 12.0(1)SU1
Cisco Unified Communications Manager 12.0(1)SU2
Cisco Unified Communications Manager 12.0(1)SU3