CVE-2011-1609

SQL injection vulnerability in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su2, 7.x before 7.1(5)su1, 8.0 before 8.0(3), and 8.5 before 8.5(1) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtg85647.

Affected products

Cisco Unified Communications Manager

Cisco Unified Communications Manager

= 6.0, 6.1\(1\), 6.1\(1a\), 6.1\(1b\), 6.1\(2\), 6.1\(2\)su1, 6.1\(2\)su1a, 6.1\(3\), 6.1\(3a\), 6.1\(3b\), 6.1\(3b\)su1, 6.1\(4\), 6.1\(4\)su1, 6.1\(4a\), 6.1\(4a\)su2, 6.1\(5\), 6.1\(5\)su1

Fix

Available

CVSS 2.0

8.5 HIGH

EPSS

19.8% (97th percentile)

Weakness

CWE-89

NVD status

Modified

Published

2011-05-03