certfr_avis - certa-2008-avi-089

CERTA-2008-AVI-089

Vulnerability from certfr_avis

Une vulnérabilité de type injection SQL a été identifiée dans Cisco Unified Communications Manager. Elle permet à une personne malintentionnée de porter atteinte à la confidentialité des données.

Description

Une vulnérabilité de type injection SQL a été identifiée dans Cisco Unified Communications Manager. Selon l'éditeur, une personne malveillante pourrait accéder à des données potentiellement confidentielles.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Cisco	Unified Communications Manager	Cisco Unified Communications Manager 6.0/6.1 versions antérieures à 6.1(1a).
	Cisco	Unified Communications Manager	Cisco Unified Communications Manager 5.0/5.1 versions antérieures à 5.1(3a) ;

References

Title

Publication Time

Tags

Bulletin de sécurité cisco-sa-20080213-cucmsql du 13 février 2008	None	vendor-advisory
Référence CVE CVE-2008-0026 :	-	other
Bulletin de sécurité Cisco 20080213-cucmsql du 13 février 2008 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Cisco Unified Communications Manager 6.0/6.1 versions ant\u00e9rieures \u00e0 6.1(1a).",
      "product": {
        "name": "Unified Communications Manager",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Unified Communications Manager 5.0/5.1 versions ant\u00e9rieures \u00e0 5.1(3a) ;",
      "product": {
        "name": "Unified Communications Manager",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 de type injection SQL a \u00e9t\u00e9 identifi\u00e9e dans Cisco\nUnified Communications Manager. Selon l\u0027\u00e9diteur, une personne\nmalveillante pourrait acc\u00e9der \u00e0 des donn\u00e9es potentiellement\nconfidentielles.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2008-0026",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0026"
    }
  ],
  "initial_release_date": "2008-02-14T00:00:00",
  "last_revision_date": "2008-02-14T00:00:00",
  "links": [
    {
      "title": "R\u00e9f\u00e9rence CVE CVE-2008-0026 :",
      "url": "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0026"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco 20080213-cucmsql du 13 f\u00e9vrier    2008 :",
      "url": "http://www.cisco.com/warp/public/707/cisco-sa-20080213-cucmsql.shtml"
    }
  ],
  "reference": "CERTA-2008-AVI-089",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2008-02-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 de type injection SQL a \u00e9t\u00e9 identifi\u00e9e dans \u003cspan\nclass=\"textit\"\u003eCisco Unified Communications Manager\u003c/span\u003e. Elle permet\n\u00e0 une personne malintentionn\u00e9e de porter atteinte \u00e0 la confidentialit\u00e9\ndes donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Cisco Unified Communications Manager",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 cisco-sa-20080213-cucmsql du 13 f\u00e9vrier 2008",
      "url": null
    }
  ]
}

CVE-2008-0026 (GCVE-0-2008-0026)

Vulnerability from cvelistv5

Published

2008-02-14 11:00

Modified

2024-08-07 07:32

Severity ?

CWE

Summary

SQL injection vulnerability in Cisco Unified CallManager/Communications Manager (CUCM) 5.0/5.1 before 5.1(3a) and 6.0/6.1 before 6.1(1a) allows remote authenticated users to execute arbitrary SQL commands via the key parameter to the (1) admin and (2) user interface pages.

References

URL

Tags

	http://www.securityfocus.com/bid/27775	vdb-entry, x_refsource_BID
	http://secunia.com/advisories/28932	third-party-advisory, x_refsource_SECUNIA
	https://exchange.xforce.ibmcloud.com/vulnerabilities/40484	vdb-entry, x_refsource_XF
	http://www.cisco.com/en/US/products/products_security_advisory09186a0080949c7c.shtml	vendor-advisory, x_refsource_CISCO
	http://www.securitytracker.com/id?1019404	vdb-entry, x_refsource_SECTRACK
	http://www.vupen.com/english/advisories/2008/0542	vdb-entry, x_refsource_VUPEN

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T07:32:24.039Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "27775",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/27775"
          },
          {
            "name": "28932",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/28932"
          },
          {
            "name": "cucm-interface-sql-injection(40484)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40484"
          },
          {
            "name": "20080213 SQL injection in Cisco Unified Communications Manager",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080949c7c.shtml"
          },
          {
            "name": "1019404",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1019404"
          },
          {
            "name": "ADV-2008-0542",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/0542"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-02-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "SQL injection vulnerability in Cisco Unified CallManager/Communications Manager (CUCM) 5.0/5.1 before 5.1(3a) and 6.0/6.1 before 6.1(1a) allows remote authenticated users to execute arbitrary SQL commands via the key parameter to the (1) admin and (2) user interface pages."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-07T12:57:01",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "27775",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/27775"
        },
        {
          "name": "28932",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/28932"
        },
        {
          "name": "cucm-interface-sql-injection(40484)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40484"
        },
        {
          "name": "20080213 SQL injection in Cisco Unified Communications Manager",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080949c7c.shtml"
        },
        {
          "name": "1019404",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1019404"
        },
        {
          "name": "ADV-2008-0542",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/0542"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "ID": "CVE-2008-0026",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SQL injection vulnerability in Cisco Unified CallManager/Communications Manager (CUCM) 5.0/5.1 before 5.1(3a) and 6.0/6.1 before 6.1(1a) allows remote authenticated users to execute arbitrary SQL commands via the key parameter to the (1) admin and (2) user interface pages."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "27775",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/27775"
            },
            {
              "name": "28932",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/28932"
            },
            {
              "name": "cucm-interface-sql-injection(40484)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40484"
            },
            {
              "name": "20080213 SQL injection in Cisco Unified Communications Manager",
              "refsource": "CISCO",
              "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080949c7c.shtml"
            },
            {
              "name": "1019404",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1019404"
            },
            {
              "name": "ADV-2008-0542",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/0542"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2008-0026",
    "datePublished": "2008-02-14T11:00:00",
    "dateReserved": "2007-12-17T00:00:00",
    "dateUpdated": "2024-08-07T07:32:24.039Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTA-2008-AVI-089

Vulnerability from certfr_avis

Description

Solution

CVE-2008-0026 (GCVE-0-2008-0026)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature