CVEvulnerability

CVE-2008-0026

6.5 MEDIUM Published 2008-02-14 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-02-14
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-89

Description

SQL injection vulnerability in Cisco Unified CallManager/Communications Manager (CUCM) 5.0/5.1 before 5.1(3a) and 6.0/6.1 before 6.1(1a) allows remote authenticated users to execute arbitrary SQL commands via the key parameter to the (1) admin and (2) user interface pages.

Affected configurations

• cisco unified callmanager 5.0 • cisco unified callmanager 5.0\(1\) • cisco unified callmanager 5.0\(2\) • cisco unified callmanager 5.0\(3\) • cisco unified callmanager 5.0\(3a\) • cisco unified callmanager 5.0\(4\) • cisco unified callmanager 5.0 4a • cisco unified callmanager 5.1 • cisco unified callmanager 6.0 • cisco unified communications manager 5.0 • cisco unified communications manager 5.0 1 • cisco unified communications manager 5.0 2 • cisco unified communications manager 5.0 3 • cisco unified communications manager 5.0 3a • cisco unified communications manager 5.0 4 • cisco unified communications manager 5.0 4a • cisco unified communications manager 5.0 4a su1 • cisco unified communications manager 6.0 • cisco unified communications manager 6.0 1 • cisco unified communications manager 6.1

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References