Vulnerability Name:

CVE-2021-1399 (CCN-199520)

Assigned:2020-11-13
Published:2021-04-07
Updated:2021-04-13
Summary:A vulnerability in the Self Care Portal of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to modify data on an affected system without proper authorization. The vulnerability is due to insufficient validation of user-supplied data to the Self Care Portal. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to modify information without proper authorization.
CVSS v3 Severity:4.3 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
3.8 Low (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
4.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
3.8 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-302
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2021-1399

Source: XF
Type: UNKNOWN
cisco-cve20211399-sec-bypass(199520)

Source: CCN
Type: Cisco Security Advisory cisco-sa-cucm-selfcare-VRWWWHgE
Cisco Unified Communications Manager Self Care Portal Authorization Bypass Vulnerability

Source: CISCO
Type: Vendor Advisory
20210407 Cisco Unified Communications Manager Self Care Portal Authorization Bypass Vulnerability

Vulnerable Configuration:Configuration 1:
  • cpe:/a:cisco:unified_communications_manager:*:*:*:*:-:*:*:* (Version >= 10.5(2) and < 12.5(1)su4)
  • OR cpe:/a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:* (Version >= 10.5(2) and < 12.5(1)su4)

    • Configuration CCN 1:
  • cpe:/a:cisco:unified_communications_manager:-:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    cisco unified communications manager *
    cisco unified communications manager *
    cisco unified communications manager -