CVE-2021-1365

Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. These vulnerabilities are due to improper validation of user-submitted parameters. An attacker could exploit these vulnerabilities by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain data or modify data that is stored in the underlying database.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-05-06 13:15

Updated : 2024-02-28 18:28


NVD link : CVE-2021-1365

Mitre link : CVE-2021-1365

CVE.ORG link : CVE-2021-1365


JSON object : View

Products Affected

cisco

  • unified_communications_manager_im_and_presence_service
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')