SQL Injection in Cisco Unified Communications Domain Manager

CVE-2015-0699

SQL injection vulnerability in the Interactive Voice Response (IVR) component in Cisco Unified Communications Manager (UCM) 10.5(1.98991.13) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCut21563.

Vulnerability class: SQL Injection

EPSS: 0.019 (78.3th percentile) — read the EPSS interpretation.

Affected products

Cisco Unified_communications_domain_manager — versions 10.5(1.98991.13), 10.5\(1.98991.13\)
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)