Medium severity · published Nov 6, 2024
CVE-2024-20457
Cisco Unified Communications Manager IM & Presence Service Information Disclosure Vulnerability
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability in the logging component of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system.
This vulnerability is due to the storage of unencrypted credentials in certain logs. An attacker could exploit this vulnerability by accessing the logs on an affected system and obtaining credentials that they may not normally have access to. A successful exploit could allow the attacker to access sensitive information from the device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
Cisco Unified Communications Manager IM and Presence Service · Cisco
11.5(1)SU6; 10.5(1)SU1; 10.5(1)SU2; 12.5(1); 10.5(2)SU2a; 11.5(1)SU3a; +34 more · source: vendor
UC
Unified Communications Manager IM And Presence Service · Cisco
10.0(1); 10.0(1)su1; 10.0(1)su2; 10.5(1); 10.5(1)su1; 10.5(1)su2; +34 more · source: NVD
Affected product
CU
Cisco Unified Communications Manager IM and Presence Service
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-20457
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-20457
Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imp-inf-disc-cUPKuA5n
More from Cisco Unified Communications Manager IM and Presence Service
9.8
CVE-2026-20045
Cisco Unified Communications Products Remote Code Execution Vulnerability
9.8
CVE-2026-76474
Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities
9.8
CVE-2026-76473
Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime.
9.3
CVE-2026-76475
Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities
8.8
CVE-2026-76478
Cisco Unified Communications Products Hardening Release: October 2026 - Improper Access Control Vulnerabilities