unified_communications_domain_manager 漏洞

高危CVE-2023-202112023/08/16

Cisco Unified Communications Manager 安全漏洞(CVE-2023-20211)

思科统一通信管理器（Unified CM）和思科统一通信管理器会话管理版（Unified CM SME）的基于Web的管理界面存在漏洞，允许经过身份验证的远程攻击者对受影响系统进行SQL注入攻击。此漏洞是由于未正确验证用户提供的输入所致。攻击者可以利用此漏洞通过使用只读或更高权限的用户身份进行应用认证，并向受影响系统发送精心构造的HTTP请求。成功利用此漏洞可能允许攻击者读取或修改底层数据库中的数据，或者提升其权限。

unified_communications_domain_managerPoC 已收录EXP 已收录

CVSS8.8EPSS 0.08%

严重CVE-2021-442282021/12/10KEV

Cisco Unified Communications - Remote Code Execution (Apache Log4j)

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

unified_communications_domain_managerPoC 已收录

CVSS10.0

中危CVE-2013-55282013/10/11

Cisco Unified Communications Manager 7/8/9 - Directory Traversal

A directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via directory traversal sequences in an unspecified input string, aka Bug ID CSCui78815

unified_communications_domain_managerPoC 已收录

CVSS4.0EPSS 61.5%

unified_communications_domain_manager

关联漏洞

Cisco Unified Communications Manager 安全漏洞(CVE-2023-20211)

Cisco Unified Communications - Remote Code Execution (Apache Log4j)

Cisco Unified Communications Manager 7/8/9 - Directory Traversal