CVE-2021-1363
Published on: 05/06/2021 12:00:00 AM UTC
Last Modified on: 05/14/2021 09:00:00 PM UTC
CVE-2021-1363 - advisory for cisco-sa-imp-inj-ereCOKjR
Source: Mitre Source: NIST CVE.ORG Print: PDF
Certain versions of Unified Communications Manager Im And Presence Service from Cisco contain the following vulnerability:
Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. These vulnerabilities are due to improper validation of user-submitted parameters. An attacker could exploit these vulnerabilities by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain data or modify data that is stored in the underlying database.
- CVE-2021-1363 has been assigned by
[email protected] to track the vulnerability - currently rated as HIGH severity. - The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.
- Affected Vendor/Software: Cisco - Cisco Unified Communications Manager IM and Presence Service version n/a
CVSS3 Score: 8.1 - HIGH
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | LOW | LOW | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | HIGH | HIGH | NONE |
CVSS2 Score: 5.5 - MEDIUM
| Access Vector ⓘ |
Access Complexity |
Authentication |
|---|---|---|
| NETWORK | LOW | SINGLE |
| Confidentiality Impact |
Integrity Impact |
Availability Impact |
| PARTIAL | PARTIAL | NONE |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| Cisco Unified Communications Manager IM & Presence Service SQL Injection Vulnerabilities | tools.cisco.com text/html |
CISCO 20210505 Cisco Unified Communications Manager IM & Presence Service SQL Injection Vulnerabilities |
Related QID Numbers
- 316971 Cisco Unified Communications Manager IM and Presence Service SQL Injection Vulnerabilities(cisco-sa-imp-inj-ereCOKjR)
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Cisco | Unified Communications Manager Im And Presence Service | All | All | All | All |
- cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:*:
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @CVEreport |
CVE-2021-1363 : Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Mana… twitter.com/i/web/status/1… | 2021-05-06 13:05:37 |