CVE-2017-6757
HighSummary
A vulnerability in Cisco Unified Communications Manager 10.5(2.10000.5), 11.0(1.10000.10), and 11.5(1.10000.6) allows an authenticated, remote attacker to conduct a blind SQL injection attack. The issue is due to a failure to validate user-supplied input used in SQL queries that bypass protection filters.
Risk Assessment
An attacker could exploit this vulnerability to modify or delete entries in some database tables, affecting the integrity of the data within the system.
Recommendation
It is recommended to update Cisco Unified Communications Manager to the latest version to mitigate this vulnerability and implement additional input validation mechanisms.
Other vulnerabilities in Cisco Unified Communications Manager
See all- CVE-2017-6791High
A vulnerability in the Trust Verification Service (TVS) of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of Transport Layer Security (TLS) traffic by the affected software.
- CVE-2016-6364High
The User Data Services (UDS) API implementation in Cisco Unified Communications Manager 11.5 allows remote attackers to bypass intended access restrictions and obtain sensitive information via unspecified API calls.
- CVE-2026-20230HighActively exploited
A vulnerability in Cisco Unified Communications Manager and Unified CM SME allows an unauthenticated remote attacker to perform SSRF attacks. The attacker can write files to the OS, potentially leading to root privilege escalation. WebDialer service must be enabled (disabled by default).
Original NVD description (English source)
A vulnerability in Cisco Unified Communications Manager 10.5(2.10000.5), 11.0(1.10000.10), and 11.5(1.10000.6) could allow an authenticated, remote attacker to conduct a blind SQL injection attack. The vulnerability is due to a failure to validate user-supplied input used in SQL queries that bypass protection filters. An attacker could exploit this vulnerability by sending crafted URLs that include SQL statements. An exploit could allow the attacker to modify or delete entries in some database tables, affecting the integrity of the data. Cisco Bug IDs: CSCve13786.