CVE-2008-2730 — Improper Authentication in Cisco Unified Communications Manager

CWE-287 — Improper AuthenticationCWE-200 — Sensitive Information ExposureCWE-3994 documents4 sources
Severity
5.0MEDIUMNVD
EPSS
0.5%
top 33.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Unified Communications Manager
Timeline
PublishedJun 26
Latest updateMay 1

Description

The Real-Time Information Server (RIS) Data Collector service in Cisco Unified Communications Manager (CUCM) 5.x before 5.1(3) and 6.x before 6.1(1) allows remote attackers to bypass authentication, and obtain cluster configuration information and statistics, via a direct TCP connection to the service port, aka Bug ID CSCsj90843.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

Patches

Patch: www.cisco.com ↗Patch: www.cisco.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-4fwq-hhhj-mfgx: The Real-Time Information Server (RIS) Data Collector service in Cisco Unified Communications Manager (CUCM) 5↗2022-05-01
▶
CVEList
CVE-2008-2730: The Real-Time Information Server (RIS) Data Collector service in Cisco Unified Communications Manager (CUCM) 5↗2008-06-26
▶

📋Vendor Advisories

1
Cisco
Cisco Unified Communications Manager Denial of Service and Authentication Bypass Vulnerabilities↗2008-06-25
▶
CVE-2008-2730 — Improper Authentication in Cisco | cvebase