Cisco UCM CVE-2018-0135 Information Disclosure Vulnerability Advisory

Critical Vulnerability Information Vulnerability ID: cisco-sa-20180207-ucm CVE Number: CVE-2018-0135 CWE Number: CWE-20 Risk Level: Medium Initial Release Date: February 7, 2018, 16:00 GMT Version: 1.0 Cisco Bug ID: CSCvf17644 CVSS Score: Base Score 4.3 Vulnerability Overview Summary: Cisco Unified Communications Manager contains a vulnerability that allows an authenticated remote attacker to access sensitive information on the affected system. Cause: The affected software improperly validates user-supplied search input. Exploit Method: Attackers can exploit this vulnerability by sending malicious requests to the affected system. Successful exploitation may allow retrieval of sensitive information from the affected system. Workarounds: No workarounds are available for this vulnerability. Affected Products Affected Products: This vulnerability affects Cisco Unified Communications Manager. For specific information on affected software releases, refer to the Cisco Bug ID at the top of this advisory. Confirmed Unaffected Products: At this time, no other Cisco products are known to be affected by this vulnerability. Fixed Software Fixed Software: For specific information on fixed software releases, refer to the Cisco Bug ID at the top of this advisory. Upgrade Recommendation: Customers are advised to regularly review the Cisco Product Security Incident Response Team (PSIRT) advisories and alerts page to determine exposure and obtain complete upgrade solutions. Hardware and Software Configuration: Customers should ensure that the devices being upgraded have sufficient memory and confirm that the current hardware and software configuration will continue to receive support from newly released versions. If there are any uncertainties, customers are encouraged to contact Cisco Technical Assistance Center (TAC) or their contracted maintenance provider. Exploitation and Public Disclosure Exploitation Status: Cisco Product Security Incident Response Team (PSIRT) has not observed any public disclosures or indications of malicious use related to the vulnerability described in this advisory. Vulnerability Source Source: This vulnerability was discovered during internal security testing. Historical Revisions Version: 1.0 Description: Initial public release Section: / Status: Final Date: February 7, 2018

Goal Reached Thanks to every supporter — we hit 100%!

Cisco UCM CVE-2018-0135 Information Disclosure Vulnerability Advisory