CVE-2013-3434 — Improper Input Validation in Cisco Unified Communications Manager

CWE-264CWE-20 — Improper Input ValidationCWE-310CWE-89 — SQL Injection5 documents4 sources
Severity
6.8MEDIUMNVD
EPSS
0.4%
top 39.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Unified Communications Manager
Timeline
PublishedJul 18
Latest updateMay 17

Description

Untrusted search path vulnerability in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(1a) allows local users to gain privileges by leveraging unspecified file-permission and environment-variable issues for privileged programs, aka Bug ID CSCui02242.

CVSS vector

AV:L/AC:L/C:C/I:C/A:CExploitability: 3.1 | Impact: 10.0

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-8r7x-834x-qfc5: Untrusted search path vulnerability in Cisco Unified Communications Manager (CUCM) 7↗2022-05-17
▶
CVEList
CVE-2013-3434: Untrusted search path vulnerability in Cisco Unified Communications Manager (CUCM) 7↗2013-07-18
▶

📋Vendor Advisories

2
Cisco
Cisco Unified Communications Manager Privilege Escalation Vulnerability↗2013-07-17
▶
Cisco
Multiple Vulnerabilities in Cisco Unified Communications Manager↗2013-07-17
▶
CVE-2013-3434 — Improper Input Validation in Cisco | cvebase