CVE-2022-20752
Medium
Description
A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an unauthenticated, remote attacker to perform a timing attack. This vulnerability is due to insufficient protection of a system password. An attacker could exploit this vulnerability by observing the time it takes the system to respond to various queries. A successful exploit could allow the attacker to determine a sensitive system password.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Cisco Unified Communications Manager
PublishedJul 6, 2022
First seenJul 6, 2022
Weakness typeCWE-208CWE-208
How to fix
Update
- cisco unified_communications_manager12.5\(1\)su6, 14su1 or later
- cisco unity_connection12.5\(1\)su6, 14su1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco unified_communications_manager | 12.5\(1\) ≤ v < 12.5\(1\)su6, 14.0 ≤ v < 14su1 | 12.5\(1\)su6, 14su1 |
| cisco unity_connection | 12.5\(1\) ≤ v < 12.5\(1\)su6, 14.0 ≤ v < 14su1 | 12.5\(1\)su6, 14su1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.