A vulnerability has been reported in Cisco Unity Express (CUE), which can be exploited by malicious users to manipulate certain information.

The vulnerability is caused due to missing restrictions in the HTTP management interface during password changes. This makes it possible for an authenticated user to change the password for another user with an expired password (including newly created users with blank/randomly selected passwords).

Successful exploitation may e.g. grant administrative privileges on a CUE module, if the changed expired password belongs to an administrative user.

The vulnerability affects any CUE Advanced Integration Module (AIM) or Network Module (NM) running CUE software versions up to 2.2(2).

Solution
Update to version 2.3(1) or later.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits Xu He and Keith Vaughan, Bank of America Application Assessment Team.

Changelog
Further details available in Customer Area

Original Advisory
http://www.cisco.com/warp/public/707/cisco-sa-20060501-cue.shtml

Deep Links
Links available in Customer Area