CVE-2008-2062 — Sensitive Information Exposure in Cisco Unified Communications Manager

CWE-264CWE-200 — Sensitive Information ExposureCWE-3994 documents4 sources
Severity
5.0MEDIUMNVD
EPSS
0.6%
top 29.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Unified Communications Manager
Timeline
PublishedJun 26
Latest updateMay 1

Description

The Real-Time Information Server (RIS) Data Collector service in Cisco Unified Communications Manager (CUCM) before 4.2(3)SR4, and 4.3 before 4.3(2)SR1, allows remote attackers to bypass authentication, and obtain cluster configuration information and statistics, via a direct TCP connection to the service port, aka Bug ID CSCsq35151.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

▶NVDcisco/unified_communications_manager4.2 — 4.2\(3\)sr4+3

Patches

Patch: www.cisco.com ↗Patch: www.cisco.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-m7w6-qvj4-9r9j: The Real-Time Information Server (RIS) Data Collector service in Cisco Unified Communications Manager (CUCM) before 4↗2022-05-01
▶
CVEList
CVE-2008-2062: The Real-Time Information Server (RIS) Data Collector service in Cisco Unified Communications Manager (CUCM) before 4↗2008-06-26
▶

📋Vendor Advisories

1
Cisco
Cisco Unified Communications Manager Denial of Service and Authentication Bypass Vulnerabilities↗2008-06-25
▶
CVE-2008-2062 — Sensitive Information Exposure in Cisco | cvebase