CVE-2022-20786

published 2022-04-21

CVE-2022-20786: A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an…

Priority P3 51 high 8.1 CVSS 3.1

AV N AC L PR L UI N S U C H I H A N

A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to improper validation of user-submitted parameters. An attacker could exploit this vulnerability by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain data or modify data that is stored in the underlying database of the affected system.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_unified_communications_manager_im_and_presence_service	—	—
cisco	unified_communications_manager_im_amp_presence_service	—	—
cisco	unified_communications_manager_im_and_presence_service	>= 11.5\(1\) < 11.5\(1\)su11	11.5\(1\)su11
cisco	unified_communications_manager_im_and_presence_service	>= 12.5\(1\) < 12.5\(1\)su6	12.5\(1\)su6
cisco	unified_communications_manager_im_and_presence_service	>= 14.0 < 14.0su1	14.0su1

CVSS provenance

nvd v3.1 8.1 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

nvd v2.0 5.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:N

vendor_cisco 5.4 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89