Lucene search

[email protected]NVD:CVE-2021-1406

HistoryApr 08, 2021 - 4:15 a.m.

CVE-2021-1406

2021-04-0804:15:12

CWE-200

CWE-538

[email protected]

web.nvd.nist.gov

cisco

vulnerability

unified communications manager

session management

sensitive information

authenticated

remote attacker

exploit

hashed credentials

elevated privileges

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

51.5%

JSON

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper inclusion of sensitive information in downloadable files. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a specific set of commands. A successful exploit could allow the attacker to obtain hashed credentials of system users. To exploit this vulnerability an attacker would need to have valid user credentials with elevated privileges.

Affected configurations

Nvd

Node

ciscounified_communications_managerMatch10.5\(2\)-

ciscounified_communications_managerMatch10.5\(2\)session_management

ciscounified_communications_managerMatch10.5\(2\)su1-

ciscounified_communications_managerMatch10.5\(2\)su1session_management

ciscounified_communications_managerMatch10.5\(2\)su2-

ciscounified_communications_managerMatch10.5\(2\)su2session_management

ciscounified_communications_managerMatch10.5\(2\)su2a-

ciscounified_communications_managerMatch10.5\(2\)su2asession_management

ciscounified_communications_managerMatch10.5\(2\)su3-

ciscounified_communications_managerMatch10.5\(2\)su3session_management

ciscounified_communications_managerMatch10.5\(2\)su3a-

ciscounified_communications_managerMatch10.5\(2\)su3asession_management

ciscounified_communications_managerMatch10.5\(2\)su4-

ciscounified_communications_managerMatch10.5\(2\)su4session_management

ciscounified_communications_managerMatch10.5\(2\)su4a-

ciscounified_communications_managerMatch10.5\(2\)su4asession_management

ciscounified_communications_managerMatch10.5\(2\)su5

ciscounified_communications_managerMatch10.5\(2\)su6-

ciscounified_communications_managerMatch10.5\(2\)su6session_management

ciscounified_communications_managerMatch10.5\(2\)su6a-

ciscounified_communications_managerMatch10.5\(2\)su6asession_management

ciscounified_communications_managerMatch10.5\(2\)su7-

ciscounified_communications_managerMatch10.5\(2\)su7session_management

ciscounified_communications_managerMatch10.5\(2\)su8-

ciscounified_communications_managerMatch10.5\(2\)su8session_management

ciscounified_communications_managerMatch10.5\(2\)su9-

ciscounified_communications_managerMatch10.5\(2\)su9session_management

ciscounified_communications_managerMatch10.5\(2\)su10-

ciscounified_communications_managerMatch10.5\(2\)su10session_management

ciscounified_communications_managerMatch11.5\(1\)-

ciscounified_communications_managerMatch11.5\(1\)session_management

ciscounified_communications_managerMatch11.5\(1\)su1-

ciscounified_communications_managerMatch11.5\(1\)su1session_management

ciscounified_communications_managerMatch11.5\(1\)su2-

ciscounified_communications_managerMatch11.5\(1\)su2session_management

ciscounified_communications_managerMatch11.5\(1\)su3-

ciscounified_communications_managerMatch11.5\(1\)su3session_management

ciscounified_communications_managerMatch11.5\(1\)su4-

ciscounified_communications_managerMatch11.5\(1\)su4session_management

ciscounified_communications_managerMatch11.5\(1\)su5-

ciscounified_communications_managerMatch11.5\(1\)su5session_management

ciscounified_communications_managerMatch11.5\(1\)su7-

ciscounified_communications_managerMatch11.5\(1\)su7session_management

ciscounified_communications_managerMatch11.5\(1\)su8-

ciscounified_communications_managerMatch11.5\(1\)su8session_management

ciscounified_communications_managerMatch11.5\(1\)su9-

ciscounified_communications_managerMatch11.5\(1\)su9session_management

ciscounified_communications_managerMatch12.0\(1\)-

ciscounified_communications_managerMatch12.0\(1\)session_management

ciscounified_communications_managerMatch12.5\(1\)-

ciscounified_communications_managerMatch12.5\(1\)session_management

ciscounified_communications_managerMatch12.5\(1\)su1-

ciscounified_communications_managerMatch12.5\(1\)su1session_management

ciscounified_communications_managerMatch12.5\(1\)su2-

ciscounified_communications_managerMatch12.5\(1\)su2session_management

ciscounified_communications_managerMatch12.5\(1\)su3-

ciscounified_communications_managerMatch12.5\(1\)su3session_management

ciscounified_communications_managerMatch12.5\(1\)su4-

ciscounified_communications_managerMatch12.5\(1\)su4session_management

ciscounified_communications_managerMatch12.5\(1\)su5-

ciscounified_communications_managerMatch12.5\(1\)su5session_management

VendorProductVersionCPE
ciscounified_communications_manager10.5(2)cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\):*:*:*:-:*:*:*
ciscounified_communications_manager10.5(2)cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\):*:*:*:session_management:*:*:*
ciscounified_communications_manager10.5(2)su1cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su1:*:*:*:-:*:*:*
ciscounified_communications_manager10.5(2)su1cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su1:*:*:*:session_management:*:*:*
ciscounified_communications_manager10.5(2)su2cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su2:*:*:*:-:*:*:*
ciscounified_communications_manager10.5(2)su2cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su2:*:*:*:session_management:*:*:*
ciscounified_communications_manager10.5(2)su2acpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su2a:*:*:*:-:*:*:*
ciscounified_communications_manager10.5(2)su2acpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su2a:*:*:*:session_management:*:*:*
ciscounified_communications_manager10.5(2)su3cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su3:*:*:*:-:*:*:*
ciscounified_communications_manager10.5(2)su3cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su3:*:*:*:session_management:*:*:*

Vendor	Product	Version	CPE
cisco	unified_communications_manager	10.5(2)	cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)::::-:::
cisco	unified_communications_manager	10.5(2)	cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)::::session_management:::
cisco	unified_communications_manager	10.5(2)su1	cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su1::::-:::
cisco	unified_communications_manager	10.5(2)su1	cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su1::::session_management:::
cisco	unified_communications_manager	10.5(2)su2	cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su2::::-:::
cisco	unified_communications_manager	10.5(2)su2	cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su2::::session_management:::
cisco	unified_communications_manager	10.5(2)su2a	cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su2a::::-:::
cisco	unified_communications_manager	10.5(2)su2a	cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su2a::::session_management:::
cisco	unified_communications_manager	10.5(2)su3	cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su3::::-:::
cisco	unified_communications_manager	10.5(2)su3	cpe:2.3:a:cisco:unified_communications_manager:10.5\(2\)su3::::session_management:::

Rows per page:

1-10 of 611

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-inf-disc-wCxZNjL2

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

51.5%

JSON

Related for NVD:CVE-2021-1406

cvelist1 cve1 nessus1 cisco1 prion1