CVE-2022-20752
published 2022-07-06CVE-2022-20752: A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and…
medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an unauthenticated, remote attacker to perform a timing attack. This vulnerability is due to insufficient protection of a system password. An attacker could exploit this vulnerability by observing the time it takes the system to respond to various queries. A successful exploit could allow the attacker to determine a sensitive system password.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_unified_communications_manager | — | — |
| cisco | unified_communications_manager | >= 12.5\(1\) < 12.5\(1\)su6 | 12.5\(1\)su6 |
| cisco | unified_communications_manager | >= 14.0 < 14su1 | 14su1 |
| cisco | unified_communications_products_timing_attack | — | — |
| cisco | unity_connection | >= 12.5\(1\) < 12.5\(1\)su6 | 12.5\(1\)su6 |
| cisco | unity_connection | >= 14.0 < 14su1 | 14su1 |