SQL Injection in Cisco Unified Meetingplace

CVE-2010-0139

Cisco Unified MeetingPlace 7 before 7.0(2.3) hotfix 5F, 6 before 6.0.639.2, and possibly 5 does not properly validate SQL commands, which allows remote attackers to create, modify, or delete data in a database via unspecified vectors, aka Bug ID CSCtc39691.

Vulnerability class: SQL Injection

EPSS: 0.020 (78.8th percentile) — read the EPSS interpretation.

Affected products

Cisco Unified_meetingplace — versions 7.0, 6.0.170.0, 6.0.244
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Patch, Vendor Advisory)
psirt@cisco.com (vdb-entry, x_refsource_BID)