CVE-2023-20116: A vulnerability in the Administrative XML Web Service (AXL) ..

cisco

Jun 28, 2023

Jul 12, 2023

Medium

5.7

/

10

Description

A vulnerability in the Administrative XML Web Service (AXL) API of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the web UI of the Self Care Portal. An attacker could exploit this vulnerability by sending crafted HTTP input to an affected device. A successful exploit could allow the attacker to cause a DoS condition on the affected device.

Products affected:

  • cisco» unified_communications_manager » 11.5\(1.10000.6\)

  • cisco» unified_communications_manager » 11.5\(1.10000.6\)

  • cisco» unified_communications_manager » 12.0\(1.10000.10\)

  • cisco» unified_communications_manager » 12.0\(1.10000.10\)

  • cisco» unified_communications_manager » 12.5\(1.10000.22\)

  • cisco» unified_communications_manager » 12.5\(1.10000.22\)

  • cisco» unified_communications_manager » 14.0\(1.10000.20\)

  • cisco» unified_communications_manager » 14.0\(1.10000.20\)

Are your APIs vulnerable to this CWE?

Are your APIs vulnerable to this CWE?

Are your APIs vulnerable to this CWE?

In a few clicks Akto can analyze your API attack surface and see what APIs are vulnerable to OWASP Top 10 and other common CWEs.

Akto BG image
Akto BG image
Akto BG image

Severity

Medium

Medium

5.7

/

10

CVSS base metrics

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

User interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Exploitability Score

2.1

Impact Score

3.6

Weakness

CWE-835__

Explore more from Akto

Blog

Be updated about everything related to API Security, new API vulnerabilities, industry news and product updates.

Test Library

Discover and find tests from Akto's 100+ API Security test library. Choose your template or add a new template to start your API Security testing.

Documentation

Check out Akto's product documentation for all information related to features and how to use them.