CVE-2017-3886

4.9 mediumEPSS 1.9%

A vulnerability in the Cisco Unified Communications Manager web interface could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. The attacker must be authenticated as an administrative user to execute SQL database queries. More Information: CSCvc74291. Known Affected Releases: 1.0(1.10000.10) 11.5(1.10000.6). Known Fixed Releases: 12.0(0.98000.619) 12.0(0.98000.485) 12.0(0.98000.212) 11.5(1.13035.1) 11.0(1.23900.5) 11.0(1.23900.2) 11.0(1.23067.1) 10.5(2.15900.2).

Severity

CVSS 3.0

4.9 medium

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2017-04-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

cisco:unified_communications_manager

References

http://www.securityfocus.com/bid/97432
http://www.securitytracker.com/id/1038192
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-ucm
http://www.securityfocus.com/bid/97432
http://www.securitytracker.com/id/1038192

Check your stack JSON