CVE-2018-0120 — SQL Injection in Cisco Unified Communications Manager

CWE-89 — SQL Injection4 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.2%
top 56.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Unified Communications ManagerCisco Unified Communications Manager
Timeline
PublishedFeb 8
Latest updateMay 13

Description

A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct an SQL injection attack against an affected system. The vulnerability exists because the affected software fails to validate user-supplied input in certain SQL queries that bypass protection filters. An attacker could exploit this vulnerability by submitting crafted HTTP requests that contain malicious SQL statements to an affected system. A successful exploit cou…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶NVDcisco/unified_communications_manager11.5\(1.13900.52\)
▶CVEListV5cisco/cisco_unified_communications_managerCisco Unified Communications Manager

🔴Vulnerability Details

2
GHSA
GHSA-f3p8-8vv7-hrvp: A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct an SQL injection↗2022-05-13
▶
CVEList
CVE-2018-0120: A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct an SQL injection↗2018-02-08
▶

📋Vendor Advisories

1
Cisco
Cisco Unified Communications Manager SQL Injection Vulnerability↗2018-02-08
▶
CVE-2018-0120 — SQL Injection in Cisco | cvebase