Cisco Unified Communications Domain Manager CVE-2015-0684 SQL Injection Vulnerability

Bugtraq ID:	73444
Class:	Input Validation Error
CVE:	CVE-2015-0684
Remote:	Yes
Local:	No
Published:	Mar 31 2015 12:00AM
Updated:	Mar 31 2015 12:00AM
Credit:	Cisco
Vulnerable:	Cisco Unified Communications Domain Manager 8.1.4
Not Vulnerable:

Cisco Unified Communications Domain Manager CVE-2015-0684 SQL Injection Vulnerability

Cisco Unified Communications Domain Manager is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an authenticated attacker to compromise the affected application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue is tracked by Cisco Bug ID CSCuq52515.

Cisco Unified Communications Domain Manager CVE-2015-0684 SQL Injection Vulnerability

An attacker can exploit this issue using a web browser.

Cisco Unified Communications Domain Manager CVE-2015-0684 SQL Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cisco Unified Communications Domain Manager CVE-2015-0684 SQL Injection Vulnerability

References:

• Cisco Homepage (Cisco)
  
• Cisco Unified Communications Domain Manager Application Software SQL Injection V (Cisco)