CVE-2008-2062
The Real-Time Information Server (RIS) Data Collector service in Cisco Unified Communications Manager (CUCM) before 4.2(3)SR4, and 4.3 before 4.3(2)SR1, allows remote attackers to bypass authentication, and obtain cluster configuration information and…
Does this matter?
Lower severity and a low EPSS score (2.31%). Track it; it rarely justifies an emergency change on its own.
Description
The Real-Time Information Server (RIS) Data Collector service in Cisco Unified Communications Manager (CUCM) before 4.2(3)SR4, and 4.3 before 4.3(2)SR1, allows remote attackers to bypass authentication, and obtain cluster configuration information and statistics, via a direct TCP connection to the service port, aka Bug ID CSCsq35151.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 2.31% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- cisco/unified communications manager
- Source
- psirt@cisco.com
References
- http://secunia.com/advisories/30848Third Party Advisory
- http://www.cisco.com/en/US/products/products_security_advisory09186a00809b9011.shtmlPatch, Vendor Advisory
- http://www.securityfocus.com/bid/29935Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1020361Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2008/1933/referencesPermissions Required
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43355Third Party Advisory, VDB Entry
- http://secunia.com/advisories/30848Third Party Advisory
- http://www.cisco.com/en/US/products/products_security_advisory09186a00809b9011.shtmlPatch, Vendor Advisory
- http://www.securityfocus.com/bid/29935Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1020361Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2008/1933/referencesPermissions Required
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43355Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.