VulnerabilityModified
CVE-2015-6299
SQL injection vulnerability in the web interface in Cisco Unity Connection 9.1(1.2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted POST request, aka Bug ID CSCuv63824.
MEDIUM 6.5EPSS 1.59%
Does this matter?
Lower severity and a low EPSS score (1.59%). Track it; it rarely justifies an emergency change on its own.
Description
SQL injection vulnerability in the web interface in Cisco Unity Connection 9.1(1.2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted POST request, aka Bug ID CSCuv63824.
- CVSS 2.0
- 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
- EPSS
- 1.59% probability · 74th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- cisco/unity connection
- Source
- psirt@cisco.com
References
- http://tools.cisco.com/security/center/viewAlert.x?alertId=41074Vendor Advisory
- http://www.securitytracker.com/id/1033622Third Party Advisory, VDB Entry
- http://tools.cisco.com/security/center/viewAlert.x?alertId=41074Vendor Advisory
- http://www.securitytracker.com/id/1033622Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.