CVE-2011-1610
Multiple SQL injection vulnerabilities in xmldirectorylist.jsp in the embedded Apache HTTP Server component in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su3, 7.x before 7.1(5)su4, 8.0 before 8.0(3a)su2, and…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 24.8%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple SQL injection vulnerabilities in xmldirectorylist.jsp in the embedded Apache HTTP Server component in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su3, 7.x before 7.1(5)su4, 8.0 before 8.0(3a)su2, and 8.5 before 8.5(1)su1 allow remote attackers to execute arbitrary SQL commands via the (1) f, (2) l, or (3) n parameter, aka Bug ID CSCtj42064.
- CVSS 2.0
- 6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
- EPSS
- 24.82% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- cisco/unified communications manager
- Source
- psirt@cisco.com
References
- http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0051.html
- http://secunia.com/advisories/44331
- http://www.cisco.com/en/US/products/products_security_advisory09186a0080b79904.shtmlVendor Advisory
- http://www.securityfocus.com/archive/1/517727/100/0/threaded
- http://www.securityfocus.com/bid/47607
- http://www.securitytracker.com/id?1025449
- http://www.vupen.com/english/advisories/2011/1122
- http://zerodayinitiative.com/advisories/ZDI-11-143/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67126
- http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0051.html
- http://secunia.com/advisories/44331
- http://www.cisco.com/en/US/products/products_security_advisory09186a0080b79904.shtmlVendor Advisory
- http://www.securityfocus.com/archive/1/517727/100/0/threaded
- http://www.securityfocus.com/bid/47607
- http://www.securitytracker.com/id?1025449
- http://www.vupen.com/english/advisories/2011/1122
- http://zerodayinitiative.com/advisories/ZDI-11-143/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67126
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.