CVE-2015-6433 — SQL Injection in Cisco Unified Communications Manager

CWE-89 — SQL Injection4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 62.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Unified Communications Manager
Timeline
PublishedJan 8
Latest updateMay 17

Description

SQL injection vulnerability in Cisco Unified Communications Manager 11.0(0.98000.225) allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCut66767.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

▶NVDcisco/unified_communications_manager11.0\(0.98000.225\)

🔴Vulnerability Details

2
GHSA
GHSA-7c4p-6jqc-44h4: SQL injection vulnerability in Cisco Unified Communications Manager 11↗2022-05-17
▶
CVEList
CVE-2015-6433: SQL injection vulnerability in Cisco Unified Communications Manager 11↗2016-01-08
▶

📋Vendor Advisories

1
Cisco
Cisco Unified Communications Manager SQL Injection Vulnerability↗2016-01-05
▶
CVE-2015-6433 — SQL Injection in Cisco | cvebase