CVE-2023-20266

Опубликовано: 30 авг. 2023

Источник: nvd

CVSS3: 6.5

CVSS3: 7.2

EPSS Низкий

Описание

This vulnerability exists because the application does not properly restrict the files that are being used for upgrades. An attacker could exploit this vulnerability by providing a crafted upgrade file. A successful exploit could allow the attacker to elevate privileges to root. To exploit this vulnerability, the attacker must have valid platform administrator credentials on an affected device.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cisco:emergency_responder:12.5.1su4:*:*:*:*:*:*:*

cpe:2.3:a:cisco:emergency_responder:12.5.1su8a:*:*:*:*:*:*:*

cpe:2.3:a:cisco:emergency_responder:14su3:*:*:*:*:*:*:*

cpe:2.3:a:cisco:unified_communications_manager:12.5.1su8:*:*:*:-:*:*:*

cpe:2.3:a:cisco:unified_communications_manager:12.5.1su8:*:*:*:session_management:*:*:*

cpe:2.3:a:cisco:unity_connection:12.5\(1\)su6:*:*:*:*:*:*:*

cpe:2.3:a:cisco:unity_connection:12.5\(1\)su7:*:*:*:*:*:*:*

cpe:2.3:a:cisco:unity_connection:12.5\(1\)su8:*:*:*:*:*:*:*

cpe:2.3:a:cisco:unity_connection:14su2:*:*:*:*:*:*:*

cpe:2.3:a:cisco:unity_connection:14su3:*:*:*:*:*:*:*

EPSS

Процентиль: 18%

0.00058

Низкий

6.5 Medium

CVSS3

7.2 High

CVSS3

Дефекты

CWE-347

CWE-269

Связанные уязвимости

GHSA-4hj2-qwwr-pxg3

CVSS3: 6.5

github

больше 2 лет назад

A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an authenticated, remote attacker to elevate privileges to root on an affected device. This vulnerability exists because the application does not properly restrict the files that are being used for upgrades. An attacker could exploit this vulnerability by providing a crafted upgrade file. A successful exploit could allow the attacker to elevate privileges to root. To exploit this vulnerability, the attacker must have valid platform administrator credentials on an affected device.

BDU:2023-05230

CVSS3: 6.5

fstec

больше 3 лет назад

Уязвимость сервера управления и мониторинга экстренных вызовов Cisco Emergency Responder, систем обработки вызовов Cisco Unified Communications Manager и Cisco Unified Communications Manager Session Management Edition (SME) и системы обмена сообщениями Cisco Unity Connection, связанная с недостатками разграничения доступа, позволяющая нарушителю повысить свои привилегии

EPSS

Процентиль: 18%

0.00058

Низкий

6.5 Medium

CVSS3

7.2 High

CVSS3

Дефекты

CWE-347

CWE-269