CVE-2014-3280 : The web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9

The web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote authenticated users to obtain potentially sensitive user information by visiting an unspecified Administration GUI web page, aka Bug IDs CSCun46045 and CSCun46116.

Published 2014-06-03 04:44:49

Updated 2016-09-07 18:17:30

Source Cisco Systems, Inc.

View at NVD, CVE.org

Products affected by CVE-2014-3280

Cisco » Unified Communications Domain Manager
Versions up to, including, (<=) 9.0\(.1\)
cpe:2.3:a:cisco:unified_communications_domain_manager:*:*:*:*:*:*:*:*
Matching versions
Cisco » Unified Communications Domain Manager » Version: 7.4
cpe:2.3:a:cisco:unified_communications_domain_manager:7.4:*:*:*:*:*:*:*
Matching versions
Cisco » Unified Communications Domain Manager » Version: 9.0
cpe:2.3:a:cisco:unified_communications_domain_manager:9.0:*:*:*:*:*:*:*
Matching versions
Cisco » Unified Communications Domain Manager » Version: 8.6
cpe:2.3:a:cisco:unified_communications_domain_manager:8.6:*:*:*:*:*:*:*
Matching versions
Cisco » Unified Communications Domain Manager » Version: 8.6(.2)
cpe:2.3:a:cisco:unified_communications_domain_manager:8.6\(.2\):*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2014-3280

EPSS FAQ

0.16%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 52 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-3280

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None

CWE ids for CVE-2014-3280

CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-3280

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3280

Cisco Unified Communications Domain Manager Admin Information Disclosure Vulnerability
Vendor Advisory
http://www.securityfocus.com/bid/67661

Cisco Unified Communications Domain Manager Remote Information Disclosure Vulnerability
Third Party Advisory;VDB Entry
http://www.securitytracker.com/id/1030306

Cisco Unified Communications Domain Manager Multiple Flaws Let Remote Users Obtain Potentially Sensitive Information - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url
http://tools.cisco.com/security/center/viewAlert.x?alertId=34379

Cisco Unified Communications Domain Manager Admin Information Disclosure Vulnerability
Vendor Advisory

Jump to

Vulnerability Details : CVE-2014-3280

Products affected by CVE-2014-3280

Exploit prediction scoring system (EPSS) score for CVE-2014-3280

CVSS scores for CVE-2014-3280

CWE ids for CVE-2014-3280

References for CVE-2014-3280