CVE-2015-4222
published 2015-06-26CVE-2015-4222: SQL injection vulnerability in Cisco Unified Communications Manager IM and Presence Service 9.1(1) allows remote authenticated users to execute arbitrary SQL…
PriorityP338medium6.5CVSS 2.0
AVNACLAuSCPIPAP
EPSS
1.99%
78.6th percentile
SQL injection vulnerability in Cisco Unified Communications Manager IM and Presence Service 9.1(1) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuq46325.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | unified_communications_manager_im_and_presence_service | — | — |
CVSS provenance
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_cisco6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2w2h-3v4h-88j6: SQL injection vulnerability in Cisco Unified Communications Manager IM and Presence Service 9
ghsa_unreviewed·2022-05-17
CVE-2015-4222 [MEDIUM] CWE-89 GHSA-2w2h-3v4h-88j6: SQL injection vulnerability in Cisco Unified Communications Manager IM and Presence Service 9
SQL injection vulnerability in Cisco Unified Communications Manager IM and Presence Service 9.1(1) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuq46325.
Cisco
Cisco IM and Presence Service SQL Injection Vulnerability
vendor_cisco·2015-06-24·CVSS 6.5
CVE-2015-4222 [MEDIUM] CWE-89 Cisco IM and Presence Service SQL Injection Vulnerability
Cisco IM and Presence Service SQL Injection Vulnerability
A vulnerability in the database of Cisco IM and Presence Service could allow an authenticated, remote attacker to impact the confidentiality, integrity, and availability of the affected system by executing arbitrary SQL queries.
The vulnerability is due to a failure to validate user-supplied input used in SQL queries. An attacker could exploit this vulnerability by sending crafted SQL statements to an affected system. An exploit could allow the attacker to read, modify, or delete entries in some database tables.
Cisco has confirmed the vulnerability and released software updates.
To exploit this vulnerability, an attacker must authenticate to the targeted system. This access requirement reduces the likelihood of a successful ex
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2015-06-26
Published