CVE-2019-15972 Public exploit Medium · 5.4 EPSS 1.6%
Cisco Unified Communications Manager SQL Injection Vulnerability
Cisco · Cisco Unified Communications Manager
Official description · CVE.org
A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management interface improperly validates SQL values. An attacker could exploit this vulnerability by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to modify values on or return values from the underlying database.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
23.9 / 100
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 7/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.How attackers get in
What they do
What can follow
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (PoC-in-GitHub) was available 7 days before disclosure.
- Public exploit codePoC-in-GitHub7 days before
- Disclosedday 0
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
5 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 5Initial AccessTA0001
MITRE CTID mapping of the CVE · how it is exploited
MITRE CTID mapping of the CVE · how it is exploited
ExecutionTA0002
MITRE CTID mapping of the CVE · primary impact
CollectionTA0009
Data from Local System T1005
MITRE CTID mapping of the CVE · follow-on activity
ImpactTA0040
Stored Data Manipulation T1565.001
MITRE CTID mapping of the CVE · follow-on activity
Detection
0 rules for this CVE · 191 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2019-15972 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Valid AccountsT107856 general rules
- Win Susp Computer Name Containing Samtheadmincriticaltest
- Account Created And Deleted Within A Close Time Framehightest
- Activity From Anonymous IP Addresshightest
- Atypical Travelhightest
- Azure AD Threat Intelligencehightest
- Azure Subscription Permission Elevation Via AuditLogshightest
- External Remote SMB Logon from Public IPhightest
- Impossible Travelhightest
External Remote ServicesT113320 general rules
- External Remote SMB Logon from Public IPhightest
- OpenCanary - SSH Login Attempthightest
- OpenCanary - SSH New Connection Attempthightest
- OpenCanary - Telnet Login Attempthightest
- Running Chrome VPN Extensions via the Registry 2 VPN Extensionhightest
- Unusual Child Process of dns.exehightest
- Unusual File Deletion by Dns.exehightest
- Unusual File Modification by dns.exehightest
Command and Scripting InterpreterT105995 general rules
- HackTool - Sliver C2 Implant Activity Patterncriticaltest
- Lazarus Group Activitycriticaltest
- REvil Kaseya Incident Malware Patternscriticaltest
- Turla Group Lateral Movementcriticaltest
- Windows Defender AMSI Trigger Detectedhighstable
- Windows Defender Threat Detectedhighstable
- Abusable DLL Potential Sideloading From Suspicious Locationhightest
- Add Insecure Download Source To Wingethightest
Data from Local SystemT100514 general rules
- OpenCanary - SMB File Open Requesthightest
- Potential Conti Ransomware Database Dumping Activity Via SQLCmdhightest
- SQLite Chromium Profile Data DB Accesshightest
- SQLite Firefox Profile Data DB Accesshightest
- VeeamBackup Database Credentials Dump Via Sqlcmd.EXEhightest
- Script Interpreter Spawning Credential Scanner - Linuxhighexperimental
- Script Interpreter Spawning Credential Scanner - Windowshighexperimental
- Shai-Hulud NPM Package Malicious Exfiltration via Curlhighexperimental
Stored Data ManipulationT1565.0016 general rules
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.