CSCwb37563 - Cisco UCM SQL Injection Vulnerability

[ChristianSeifert62512]

Hello community,

regarding this bug and CVE-2023-20010, are all websites of UCM affected (including ucmuser) or only ccmadmin, cmplatform etc.?

Thanks for any hint.

Greetings, Chris

[AHenneberger]

Hi Chris, 

I opened a TAC case for clarification and got reply that only /ccmadmin is affected by this vulnerability. Based on this an attacker needs at least a low priviledged admin account to use that exploit.

Cheers,

Alex