CVE-2017-12302

MEDIUM

Cisco Unified Communications Manager - SQL Injection

Title source: llm
STIX 2.1

Description

A vulnerability in the Cisco Unified Communications Manager SQL database interface could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. The vulnerability is due to a lack of input validation on user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected system. An exploit could allow the attacker to determine the presence of certain values in the database. Cisco Bug IDs: CSCvf36682.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1039826
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/101853

Scores

CVSS v3 4.3
EPSS 0.0113
EPSS Percentile 62.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-89
Status published
Products (5)
cisco/unified_communications_domain_manager 10.5\(2.10000.5\)
cisco/unified_communications_domain_manager 11.0\(1.10000.10\)
cisco/unified_communications_domain_manager 11.5\(1.10000.6\)
cisco/unified_communications_domain_manager 12.0\(1.10000.10\)
n/a/Cisco Unified Communications Manager Cisco Unified Communications Manager
Published Nov 16, 2017
Tracked Since Feb 18, 2026