CVE-2014-0728 : SQL injection vulnerability in the Java database interface in Cisco Unified Communications Manager (UCM) 10.0(1) and ear

SQL injection vulnerability in the Java database interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05313.

Published 2014-02-13 05:24:52

Updated 2015-08-05 15:40:47

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: Sql Injection

Threat overview for CVE-2014-0728

Top countries where our scanners detected CVE-2014-0728

Top open port discovered on systems with this issue 22

IPs affected by CVE-2014-0728 2

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2014-0728!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2014-0728

EPSS FAQ

0.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 57 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-0728

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2014-0728

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-0728

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0728

Cisco Unified Communications Manager Java Interface SQL Injection Vulnerability
Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=32834

Cisco Unified Communications Manager Java Interface SQL Injection Vulnerability
Vendor Advisory
http://www.securityfocus.com/bid/65499

Cisco Unified Communications Manager Java Database Interface SQL Injection Vulnerability

Products affected by CVE-2014-0728