CVE-2021-1365

Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. These vulnerabilities are due to improper validation of user-submitted parameters. An attacker could exploit these vulnerabilities by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain data or modify data that is stored in the underlying database.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:44

Type Values Removed Values Added
CVSS v2 : 5.5
v3 : 8.1
v2 : 5.5
v3 : 7.1
References () https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imp-inj-ereCOKjR - Vendor Advisory () https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imp-inj-ereCOKjR - Vendor Advisory

Information

Published : 2021-05-06 13:15

Updated : 2024-11-21 05:44


NVD link : CVE-2021-1365

Mitre link : CVE-2021-1365

CVE.ORG link : CVE-2021-1365


JSON object : View

Products Affected

cisco

  • unified_communications_manager_im_and_presence_service
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')