CVE-2022-20816
Published on: Not Yet Published
Last Modified on: 08/12/2022 06:02:00 PM UTC
CVE-2022-20816 - advisory for cisco-sa-cucm-file-delete-N2VPmOnE
Source: Mitre Source: NIST CVE.ORG Print: PDF
Certain versions of Unified Communications Manager from Cisco contain the following vulnerability:
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to delete arbitrary files from an affected system. This vulnerability exists because the affected software does not properly validate HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. A successful exploit could allow the attacker to delete arbitrary files from the affected system.
- CVE-2022-20816 has been assigned by
[email protected] to track the vulnerability - currently rated as HIGH severity. - The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerability described in this advisory.
- Affected Vendor/Software: Cisco - Cisco Unified Communications Manager version n/a
CVSS3 Score: 8.1 - HIGH
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | LOW | LOW | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | NONE | HIGH | HIGH |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| No Description Provided | tools.cisco.com text/html |
CISCO 20220803 Cisco Unified Communications Manager Arbitrary File Deletion Vulnerability |
Related QID Numbers
- 317214 Cisco Unified Communications Manager Arbitrary File Deletion Vulnerability (cisco-sa-cucm-file-delete-N2VPmOnE)
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Cisco | Unified Communications Manager | All | All | All | All |
| Application | Cisco | Unified Communications Manager | All | All | All | All |
- cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:-:*:*:*:
- cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:*:
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @sidfm_jp |
Cisco Unified CM の Web 管理インターフェイスの処理に任意のファイルを削除される問題 (CVE-2022-20816) [42962] sid.softek.jp/content/show/4… #SIDfm #脆弱性情報 | 2022-08-04 07:30:11 |
| @CVEreport |
CVE-2022-20816 : A vulnerability in the web-based management interface of Cisco Unified Communications Manager U… twitter.com/i/web/status/1… | 2022-08-10 08:19:15 |
 /r/netcve |
CVE-2022-20816 | 2022-08-10 09:38:01 |