CVE-2021-1355
Description
Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities that affects Unified CM IM&P also affects Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) and could allow an attacker to conduct SQL injection attacks on an affected system. For more information about these vulnerabilities, see the Details section of this advisory.
How to fix
- cisco unified_communications_manager11.5\(1\)su9, 12.0\(1\)su4, 12.5\(1\)su4 or later
- cisco unified_communications_manager_im_and_presence_service11.5\(1\)su9, 12.5\(1\)su4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco unified_communications_manager | v < 11.5\(1\)su9, 12.0 ≤ v < 12.0\(1\)su4, 12.5 ≤ v < 12.5\(1\)su4 | 11.5\(1\)su9, 12.0\(1\)su4, 12.5\(1\)su4 |
| cisco unified_communications_manager_im_and_presence_service | v < 11.5\(1\)su9, 12.0 ≤ v < 12.5\(1\)su4 | 11.5\(1\)su9, 12.5\(1\)su4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.