CVE-2008-1748

HighCVSS 7.8/10Last modified Jun 16, 2026

Description

Cisco Unified Communications Manager 4.1 before 4.1(3)SR7, 4.2 before 4.2(3)SR4, 4.3 before 4.3(2), 5.x before 5.1(3), and 6.x before 6.1(1) does not properly validate SIP URLs, which allows remote attackers to cause a denial of service (service interruption) via a SIP INVITE message, aka Bug ID CSCsl22355.

Metrics

CVSS 2.0 7.8/10AV:N/AC:L/Au:N/C:N/I:N/A:C

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/30238Third Party Advisory
http://securitytracker.com/id?1020022Third Party Advisory, VDB Entry
http://www.cisco.com/en/US/products/products_security_advisory09186a0080995688.shtmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/29221Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2008/1533Permissions Required
https://exchange.xforce.ibmcloud.com/vulnerabilities/42419Third Party Advisory, VDB Entry
http://secunia.com/advisories/30238Third Party Advisory
http://securitytracker.com/id?1020022Third Party Advisory, VDB Entry
http://www.cisco.com/en/US/products/products_security_advisory09186a0080995688.shtmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/29221Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2008/1533Permissions Required
https://exchange.xforce.ibmcloud.com/vulnerabilities/42419Third Party Advisory, VDB Entry

Timeline

Published: May 16, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-17497.8Memory leak in Cisco Content Switching Module (CSM) 4.2(3) up to 4.2(8) and Cisco Content Switching Module with SSL (CSM-S) 2.1(2) up to 2.1 CVE-2008-17507.5SQL injection vulnerability in Integry Systems LiveCart 1.1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the CVE-2008-17516.8Multiple directory traversal vulnerabilities in index.php in Ksemail allow remote attackers to read arbitrary local files via a .. (dot dot)CVE-2008-17527.5ezRADIUS 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain crede CVE-2008-17534.3Cross-site scripting (XSS) vulnerability in system/workplace/admin/workplace/sessions.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers t CVE-2008-17541.7Symantec Altiris Deployment Solution before 6.9.164 stores the Deployment Solution Agent (aka AClient) password in cleartext in memory, whic CVE-2008-17555.0Directory traversal vulnerability in the showSource function in showSource.php in World of Phaos 4.0.1 allows remote attackers to read arbit CVE-2008-17564.9Unspecified vulnerability in the Qmaster daemon in Sun N1 Grid Engine 6.1 allows local users to cause a denial of service (daemon crash) via CVE-2008-17574.3Cross-site scripting (XSS) vulnerability in index.php in the ConcoursPhoto module for KwsPHP 1.0 allows remote attackers to inject arbitrary CVE-2008-17587.5SQL injection vulnerability in the ConcoursPhoto module for KwsPHP allows remote attackers to execute arbitrary SQL commands via the C_ID pa CVE-2008-17597.5SQL injection vulnerability in the jeuxflash module for KwsPHP allows remote attackers to execute arbitrary SQL commands via the cat paramet CVE-2008-17606.8Multiple PHP remote file inclusion vulnerabilities in Blogator-script before 1.01 allow remote attackers to execute arbitrary PHP code via a