Sign-up

ID

VAR-202207-0227


CVE

CVE-2022-20791


TITLE

plural  Cisco  Past traversal vulnerabilities in products

Trust: 0.8

sources: JVNDB: JVNDB-2022-016240

DESCRIPTION

A vulnerability in the database user privileges of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. This vulnerability is due to insufficient file permission restrictions. An attacker could exploit this vulnerability by sending a crafted command from the API to the application. A successful exploit could allow the attacker to read arbitrary files on the underlying operating system of the affected device. The attacker would need valid user credentials to exploit this vulnerability

Trust: 2.34

sources: NVD: CVE-2022-20791 // JVNDB: JVNDB-2022-016240 // CNVD: CNVD-2022-50625 // VULHUB: VHN-405344 // VULMON: CVE-2022-20791

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-50625

AFFECTED PRODUCTS

vendor:ciscomodel:unified communications managerscope:gteversion:12.5

Trust: 1.0

vendor:ciscomodel:unified communications manager im and presence servicescope:gteversion:14.0

Trust: 1.0

vendor:ciscomodel:unified communications managerscope:lteversion:11.5\(1.10000.6\)

Trust: 1.0

vendor:ciscomodel:unified communications managerscope:gteversion:14.0

Trust: 1.0

vendor:ciscomodel:unified communications managerscope:lteversion:12.5\(1.10000.22\)

Trust: 1.0

vendor:ciscomodel:unified communications manager im and presence servicescope:lteversion:12.5\(1\)

Trust: 1.0

vendor:ciscomodel:unified communications managerscope:lteversion:14.0\(1.10000.20\)

Trust: 1.0

vendor:ciscomodel:unified communications manager im and presence servicescope:ltversion:14su2

Trust: 1.0

vendor:シスコシステムズmodel:cisco unified communications managerscope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco unified communications manager im and presence servicescope: - version: -

Trust: 0.8

vendor:ciscomodel:unified communications managerscope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2022-50625 // JVNDB: JVNDB-2022-016240 // NVD: CVE-2022-20791

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-20791
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2022-20791
value: MEDIUM

Trust: 1.0

NVD: CVE-2022-20791
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2022-50625
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202207-435
value: MEDIUM

Trust: 0.6

VULHUB: VHN-405344
value: MEDIUM

Trust: 0.1

VULMON: CVE-2022-20791
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2022-20791
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2022-50625
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:L/AU:S/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-405344
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2022-20791
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 3.6
version: 3.1

Trust: 2.0

NVD: CVE-2022-20791
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2022-50625 // VULHUB: VHN-405344 // VULMON: CVE-2022-20791 // JVNDB: JVNDB-2022-016240 // CNNVD: CNNVD-202207-435 // NVD: CVE-2022-20791 // NVD: CVE-2022-20791

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.1

problemtype:CWE-36

Trust: 1.0

problemtype:Path traversal (CWE-22) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-405344 // JVNDB: JVNDB-2022-016240 // NVD: CVE-2022-20791

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202207-435

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-202207-435

PATCH

title:cisco-sa-cucm-imp-afr-YBFLNyzdurl:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-imp-afr-YBFLNyzd

Trust: 0.8

title:Patch for Arbitrary File Read Vulnerability in Cisco Unified Communications Managerurl:https://www.cnvd.org.cn/patchInfo/show/338886

Trust: 0.6

title:Cisco Unified Communications Manager Repair measures for path traversal vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=199988

Trust: 0.6

title:Cisco: Cisco Unified Communications Products Arbitrary File Read Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-cucm-imp-afr-YBFLNyzd

Trust: 0.1

title:CVE-2022-XXXXurl:https://github.com/AlphabugX/CVE-2022-23305

Trust: 0.1

title:CVE-2022-XXXXurl:https://github.com/AlphabugX/CVE-2022-RCE

Trust: 0.1

sources: CNVD: CNVD-2022-50625 // VULMON: CVE-2022-20791 // JVNDB: JVNDB-2022-016240 // CNNVD: CNNVD-202207-435

EXTERNAL IDS

db:NVDid:CVE-2022-20791

Trust: 4.0

db:JVNDBid:JVNDB-2022-016240

Trust: 0.8

db:CNVDid:CNVD-2022-50625

Trust: 0.7

db:AUSCERTid:ESB-2022.3302

Trust: 0.6

db:CS-HELPid:SB2022070621

Trust: 0.6

db:CNNVDid:CNNVD-202207-435

Trust: 0.6

db:VULHUBid:VHN-405344

Trust: 0.1

db:VULMONid:CVE-2022-20791

Trust: 0.1

sources: CNVD: CNVD-2022-50625 // VULHUB: VHN-405344 // VULMON: CVE-2022-20791 // JVNDB: JVNDB-2022-016240 // CNNVD: CNNVD-202207-435 // NVD: CVE-2022-20791

REFERENCES

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-cucm-imp-afr-ybflnyzd

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-20791

Trust: 1.4

url:https://cxsecurity.com/cveshow/cve-2022-20791/

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022070621

Trust: 0.6

url:https://vigilance.fr/vulnerability/cisco-unified-communications-manager-file-reading-38744

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.3302

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/22.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://github.com/alphabugx/cve-2022-23305

Trust: 0.1

sources: CNVD: CNVD-2022-50625 // VULHUB: VHN-405344 // VULMON: CVE-2022-20791 // JVNDB: JVNDB-2022-016240 // CNNVD: CNNVD-202207-435 // NVD: CVE-2022-20791

SOURCES

db:CNVDid:CNVD-2022-50625
db:VULHUBid:VHN-405344
db:VULMONid:CVE-2022-20791
db:JVNDBid:JVNDB-2022-016240
db:CNNVDid:CNNVD-202207-435
db:NVDid:CVE-2022-20791

LAST UPDATE DATE

2024-08-14T13:53:11.918000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-50625date:2022-07-09T00:00:00
db:VULHUBid:VHN-405344date:2022-07-14T00:00:00
db:VULMONid:CVE-2022-20791date:2023-11-07T00:00:00
db:JVNDBid:JVNDB-2022-016240date:2023-10-03T06:25:00
db:CNNVDid:CNNVD-202207-435date:2022-07-15T00:00:00
db:NVDid:CVE-2022-20791date:2023-11-07T03:42:57.940

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-50625date:2022-07-08T00:00:00
db:VULHUBid:VHN-405344date:2022-07-06T00:00:00
db:VULMONid:CVE-2022-20791date:2022-07-06T00:00:00
db:JVNDBid:JVNDB-2022-016240date:2023-10-03T00:00:00
db:CNNVDid:CNNVD-202207-435date:2022-07-06T00:00:00
db:NVDid:CVE-2022-20791date:2022-07-06T21:15:11.497