CVE-2017-12302

CWE-89 — SQL Injection4 documents4 sources
Severity
4.3MEDIUM
EPSS
0.2%
top 59.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Unified Communications Domain Manager
Timeline
PublishedNov 16
Latest updateMay 13

Description

A vulnerability in the Cisco Unified Communications Manager SQL database interface could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. The vulnerability is due to a lack of input validation on user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected system. An exploit could allow the attacker to determin…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5cisco_unified_communications_managerCisco Unified Communications Manager

🔴Vulnerability Details

2
GHSA
GHSA-qp82-g45g-7j94: A vulnerability in the Cisco Unified Communications Manager SQL database interface could allow an authenticated, remote attacker to impact the confide↗2022-05-13
▶
CVEList
CVE-2017-12302: A vulnerability in the Cisco Unified Communications Manager SQL database interface could allow an authenticated, remote attacker to impact the confide↗2017-11-16
▶

📋Vendor Advisories

1
Cisco
Cisco Unified Communications Manager SQL Injection Vulnerability↗2017-11-16
▶
CVE-2017-12302 (MEDIUM CVSS 4.3) | A vulnerability in the Cisco Unifie | cvebase.io