CVE-2019-15963 Cisco Unified Communications Manager Information Disclosure Vulnerability

Medium 4.3 Published 23 Sep 2020 Updated 13 Nov 2024

Authenticated attackers can view sensitive configuration data in the Cisco Unified Communications Manager web interface due to insufficient input protection.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-15963?

CVE-2019-15963 is a medium-severity vulnerability in Cisco Unified Communications Manager, published on 23 Sep 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitive information in the web-based management interface of the affected software. The vulnerability is due to insufficient protection of user-supplied input by the web-based management interface of the affected service. An attacker could exploit this vulnerability by accessing the interface and viewing restricted portions of the software configuration. A successful exploit could allow the attacker to gain access to sensitive information or conduct further attacks.

Weakness: CWE-200

Which versions are affected by CVE-2019-15963?

It affects 1 product.

Products include Cisco Unified Communications Manager.

How do I fix CVE-2019-15963?

No fix has been published for CVE-2019-15963 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-15963 being exploited?

There is no known exploitation of CVE-2019-15963 in the wild and no public exploit code.

All Cisco Unified Communications Manager vulnerabilities

Sources

Also known as GHSA-hx2m-2hr2-8gjh.