CVE-2022-20790

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to read arbitrary files from the underlying operating system. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to access sensitive files on the underlying operating system.

• CWE-23
• CWE-22

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucm-file-read-h8h4HEJ3Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucm-file-read-h8h4HEJ3Vendor Advisory

Published

Apr 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-20785On April 20, 2022, the following vulnerability in the ClamAV…7.5
• CVE-2022-20786A vulnerability in the web-based management interface of Cis…8.1
• CVE-2022-20787A vulnerability in the web-based management interface of Cis…6.8
• CVE-2022-20788A vulnerability in the web-based management interface of Cis…6.1
• CVE-2022-20789A vulnerability in the software upgrade process of Cisco Uni…6.5
• CVE-2022-2079Cross-site Scripting (XSS) - Stored in GitHub repository noc…5.4
• CVE-2022-20791A vulnerability in the database user privileges of Cisco Uni…6.5
• CVE-2022-20792A vulnerability in the regex module used by the signature da…7.8
• CVE-2022-20793A vulnerability in pairing process of Cisco TelePresenc…6.8
• CVE-2022-20794Multiple vulnerabilities in the web engine of Cisco TelePres…4.7
• CVE-2022-20795A vulnerability in the implementation of the Datagram TLS (D…7.5
• CVE-2022-20796On May 4, 2022, the following vulnerability in the ClamAV sc…5.5