CVE-2022-20791

A vulnerability in the database user privileges of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. This vulnerability is due to insufficient file permission restrictions. An attacker could exploit this vulnerability by sending a crafted command from the API to the application. A successful exploit could allow the attacker to read arbitrary files on the underlying operating system of the affected device. The attacker would need valid user credentials to exploit this vulnerability.

• CWE-36
• CWE-22

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-imp-afr-YBFLNyzdVendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-imp-afr-YBFLNyzdVendor Advisory

Published

Jul 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-20786A vulnerability in the web-based management interface of Cis…8.1
• CVE-2022-20787A vulnerability in the web-based management interface of Cis…6.8
• CVE-2022-20788A vulnerability in the web-based management interface of Cis…6.1
• CVE-2022-20789A vulnerability in the software upgrade process of Cisco Uni…6.5
• CVE-2022-2079Cross-site Scripting (XSS) - Stored in GitHub repository noc…5.4
• CVE-2022-20790A vulnerability in the web-based management interface of Cis…6.5
• CVE-2022-20792A vulnerability in the regex module used by the signature da…7.8
• CVE-2022-20793A vulnerability in pairing process of Cisco TelePresenc…6.8
• CVE-2022-20794Multiple vulnerabilities in the web engine of Cisco TelePres…4.7
• CVE-2022-20795A vulnerability in the implementation of the Datagram TLS (D…7.5
• CVE-2022-20796On May 4, 2022, the following vulnerability in the ClamAV sc…5.5
• CVE-2022-20797A vulnerability in the web-based management interface of Cis…9.1