Resource exhaustion in Cisco Unified Communications Manager Im And Presence Service
CVE-2023-20108
A vulnerability in the XCP Authentication Service of the Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an unauthenticated, remote attacker to cause a temporary service outage for all Cisco Unified CM IM&P users who are attempting to authenticate to the service, resulting in a denial of service (DoS) condition. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted login message to the affected device. A successful exploit could allow the attacker to cause an unexpected restart of the authentication service, preventing new users from successfully authenticating. Exploitation of this vulnerability does not impact Cisco Unified CM IM&P users who were authenticated prior to an attack.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.009 (60.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 60th percentile — 60.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000
Affected products
- Cisco Unified Communications Manager Im And Presence Service — versions 10.5(1), 10.5(2), 10.5(2a)
- Cisco Unified Communications Manager Im And Presence Service — versions 12.5(1), 12.5\(1\), 14su
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2023-20108?
- CVE-2023-20108 is a high-severity vulnerability in Cisco Unified Communications Manager Im And Presence Service, classified under CWE-789. CVSS score: 7.5/10. Published 2023-06-28.
- How severe is CVE-2023-20108?
- High severity. CVSS v3 base score is 7.5 out of 10.