CVE-2013-3404

Cisco Unified Communications Manager 7.1-9.1(1a) - SQL Injection

Title source: llm

Description

SQL injection vulnerability in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(1a) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, leading to discovery of encrypted credentials by leveraging metadata, aka Bug ID CSCuh01051.

References (2)

Core 2

Core References

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/54249

Vendor Advisory vendor-advisory x_refsource_cisco

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130717-cucm

Scores

EPSS 0.0113

EPSS Percentile 63.0%

Details

CWE

CWE-89

Status published

Products (50)

cisco/unified_communications_manager 7.1\(2a\)

cisco/unified_communications_manager 7.1\(2a\)su1

cisco/unified_communications_manager 7.1\(2b\)

cisco/unified_communications_manager 7.1\(2b\)su1

cisco/unified_communications_manager 7.1\(3\)

cisco/unified_communications_manager 7.1\(3a\)

cisco/unified_communications_manager 7.1\(3a\)su1

cisco/unified_communications_manager 7.1\(3a\)su1a

cisco/unified_communications_manager 7.1\(3b\)

cisco/unified_communications_manager 7.1\(3b\)su1

... and 40 more

Published Jul 18, 2013

Tracked Since Feb 18, 2026