Cisco Unified Communications Manager SQL Injection Vulnerability [CVE-2017-3886]

Known affected releases:

1.0(1.10000.10)

11.5(1.10000.6)

Security researchers have found that Cisco Unified Communications Manager (Cisco Unified CM / CallManager) is vulnerable to an SQL-injection. The attack would compromise the application, allowing data to be accessed and modified as well as exploiting hidden vulnerabilities in the underlying database.

Researchers have reported that only authenticated attackers can exploit the vulnerability in Cisco Unified CM. If exploited, an authenticated, remote attacker could execute arbitrary SQL queries.

A successful SQL injection exploit can lead to the unauthorised exposure of sensitive data from the database, the execution of unauthorised administrative operations on the database and even modification or deletion of the database. Therefore, an attack would impact on the confidentiality, integrity and availability of the system.

The reported vulnerability occurs due to a lack of input validation on HTTP requests which encompass user-provided input. An attacker could exploit this vulnerability by sending constructed HTTP requests that contain malicious SQL statements. The vulnerability can also allow a remote attacker to check if certain data exists in the application.

CVE identifier:

Affected Products:

Known affected releases:

Known Fixed Releases: