CVE-2021-1282

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) (affected versions not specified) Cisco Unified Communications Manager (Unified CM) (affected versions not specified) Cisco Unified Communications Manager Session Management Edition (Unified CM SME) (affected versions not specified)

Description The issue is related to multiple vulnerabilities that could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities affects not only Cisco Unified Communications Manager IM & Presence Service but also Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition. This could enable an attacker to conduct SQL injection attacks. The vulnerability is also related to incorrect restriction of directory path names in the web interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager SME, which may allow a remote attacker to gain unauthorized access to protected information.

Recommendations For Cisco Unified Communications Manager IM & Presence Service, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Cisco Unified Communications Manager, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Cisco Unified Communications Manager Session Management Edition, at the moment, there is no information about a newer version that contains a fix for this vulnerability.