CVE-2022-20789

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 21-04-2022 09:15

Last modified: - 03-05-2022 06:56

Total changes: - 3

Description

A vulnerability in the software upgrade process of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to write arbitrary files on the affected system. This vulnerability is due to improper restrictions applied to a system script. An attacker could exploit this vulnerability by using crafted variables during the execution of a system upgrade. A successful exploit could allow the attacker to overwrite or append arbitrary data to system files using root-level privileges.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Low

Attack complexity

Network

Attack vector

High

Availability

None

Confidentiality

High

Integrity

High

Privileges required

Unchanged

Scope

None

User interaction

6.5

Base score

1.2

5.2

Exploitability score

Impact score

Verification logic

vendor=cisco AND product=unified_communications_manager AND version=12.5\(1\) AND software_edition=-

vendor=cisco AND product=unified_communications_manager AND version=12.5\(1\) AND software_edition=session_management

vendor=cisco AND product=unified_communications_manager AND version=14.0 AND software_edition=-

vendor=cisco AND product=unified_communications_manager AND version=14.0 AND software_edition=session_management

Reference

20220420 Cisco Unified Communications Products Arbitrary File Write Vulnerability-Vendor Advisory

Keywords

CVE-2022-20789

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2022-20789

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures