What is CVE-2021-1364?

CVE-2021-1364 is a medium-severity vulnerability in Cisco Unified Communications Manager, classified under Path Traversal: '.../...//'. CVSS score: 6.5/10. Published 2021-01-20.

How severe is CVE-2021-1364?

Medium severity. CVSS v3 base score is 6.5 out of 10.

SQL Injection in Cisco Unified Communications Manager

CVE-2021-1364

Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities that affects Unified CM IM&P also affects Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) and could allow an attacker to conduct SQL injection attacks on an affected system. For more information about these vulnerabilities, see the Details section of this advisory.

EPSS: 0.013 (69.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Weakness classification (CWE)

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2021-1364?: CVE-2021-1364 is a medium-severity vulnerability in Cisco Unified Communications Manager, classified under Path Traversal: '.../...//'. CVSS score: 6.5/10. Published 2021-01-20.
How severe is CVE-2021-1364?: Medium severity. CVSS v3 base score is 6.5 out of 10.