Unscored severity · published Aug 31, 2007
CVE-2007-4634
Multiple SQL injection vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before…
–
CVSS
4.3%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before 4.3(1)sr1 allow remote attackers to execute arbitrary SQL commands via the lang variable to the (1) user or (2) admin logon page, aka CSCsi64265.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.3% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Call Manager · Cisco
3.3(5)sr1; 3.3(5)sr2; 3.3(5)sr2a; 4.1; 4.1(3)sr1; 4.1(3)sr2; +10 more · source: NVD
UC
Unified Communications Manager · Cisco
3.3(5); 3.3(5)sr1; 3.3(5)sr2a; 4.1(3); 4.1(3)sr1; 4.1(3)sr2; +9 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-4634
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-4634
Vendor Advisory
http://secunia.com/advisories/26641
securitytracker.com
http://securitytracker.com/id?1018624
www.cisco.com
http://www.cisco.com/en/US/products/products_security_advisory09186a00808ae327.shtml
Exploit
http://www.securityfocus.com/bid/25480
www.vupen.com
http://www.vupen.com/english/advisories/2007/3010
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/36326
More from Call Manager
7.5
CVE-2004-0079
The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake…
–
CVE-2007-5468
Cisco CallManager 5.1.1.3000-5 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest…
–
CVE-2007-4633
Multiple cross-site scripting (XSS) vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2,…
–
CVE-2007-2832
Cross-site scripting (XSS) vulnerability in the web application firewall in Cisco CallManager before 3.3(5)sr3, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before…
–
CVE-2007-1467
Multiple cross-site scripting (XSS) vulnerabilities in (1) PreSearch.html and (2) PreSearch.class in Cisco Secure Access Control Server (ACS), VPN Client, Unified Personal…