CVE-2022-20789 — External Control of File Name or Path in Cisco Unified Communications Manager

CWE-73 — External Control of File Name or PathCWE-610 — Externally Controlled Reference to a Resource in Another Sphere4 documents4 sources
Severity
6.5MEDIUMNVD
CNA4.9
EPSS
0.9%
top 25.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Unified Communications ManagerCisco Unified Communications Manager
Timeline
PublishedApr 21
Latest updateApr 22

Description

A vulnerability in the software upgrade process of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to write arbitrary files on the affected system. This vulnerability is due to improper restrictions applied to a system script. An attacker could exploit this vulnerability by using crafted variables during the execution of a system upgrade. A successful exploit could…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:HExploitability: 1.2 | Impact: 5.2

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-8rhg-6qwg-6c3v: A vulnerability in the software upgrade process of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session↗2022-04-22
▶
CVEList
Cisco Unified Communications Products Arbitrary File Write Vulnerability↗2022-04-21
▶

📋Vendor Advisories

1
Cisco
Cisco Unified Communications Products Arbitrary File Write Vulnerability↗2022-04-20
▶