CVE-2022-20790
Published on: Not Yet Published
Last Modified on: 05/03/2022 03:29:00 PM UTC
CVE-2022-20790 - advisory for cisco-sa-ucm-file-read-h8h4HEJ3
Source: Mitre Source: NIST CVE.ORG Print: PDF
Certain versions of Unified Communications Manager from Cisco contain the following vulnerability:
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to read arbitrary files from the underlying operating system. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to access sensitive files on the underlying operating system.
- CVE-2022-20790 has been assigned by
[email protected] to track the vulnerability - currently rated as MEDIUM severity. - The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
- Affected Vendor/Software: Cisco - Cisco Unified Communications Manager version n/a
CVSS3 Score: 6.5 - MEDIUM
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | LOW | LOW | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | HIGH | NONE | NONE |
CVSS2 Score: 4 - MEDIUM
| Access Vector ⓘ |
Access Complexity |
Authentication |
|---|---|---|
| NETWORK | LOW | SINGLE |
| Confidentiality Impact |
Integrity Impact |
Availability Impact |
| PARTIAL | NONE | NONE |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| No Description Provided | tools.cisco.com text/html |
CISCO 20220420 Cisco Unified Communications Products Arbitrary File Read Vulnerability |
Related QID Numbers
- 317168 Cisco Unified Communications Products Arbitrary File Read Vulnerability (cisco-sa-ucm-file-read-h8h4HEJ3)
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Cisco | Unified Communications Manager | All | All | All | All |
| Application | Cisco | Unified Communications Manager | All | All | All | All |
- cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:-:*:*:*:
- cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:*:
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @sidfm_jp |
Cisco Unified CM の Web 管理インターフェイスの処理に任意のファイルを読み取られる問題 (CVE-2022-20790) [41927] sid.softek.jp/content/show/4… #SIDfm #脆弱性情報 | 2022-04-22 08:00:04 |
 /r/netcve |
CVE-2022-20790 | 2022-04-21 19:38:20 |