CVE-2007-4634
Multiple SQL injection vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before 4.3(1)sr1 allow remote attackers to execute arbitrary SQL commands via…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.31%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Multiple SQL injection vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before 4.3(1)sr1 allow remote attackers to execute arbitrary SQL commands via the lang variable to the (1) user or (2) admin logon page, aka CSCsi64265.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 4.31% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- cisco/unified communications manager · cisco/call manager
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/26641Vendor Advisory
- http://securitytracker.com/id?1018624
- http://www.cisco.com/en/US/products/products_security_advisory09186a00808ae327.shtml
- http://www.securityfocus.com/bid/25480Exploit
- http://www.vupen.com/english/advisories/2007/3010
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36326
- http://secunia.com/advisories/26641Vendor Advisory
- http://securitytracker.com/id?1018624
- http://www.cisco.com/en/US/products/products_security_advisory09186a00808ae327.shtml
- http://www.securityfocus.com/bid/25480Exploit
- http://www.vupen.com/english/advisories/2007/3010
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36326
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.