PT-2014-3752 · Cisco · Cisco Unified Communications Manager

Publicado 2014-01-08 · Atualizado 2017-08-29 · CVE-2014-0657

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager (Unified CM) versions 9.1(1) and earlier

Description The administration portal in Cisco Unified Communications Manager does not properly handle role restrictions. This allows remote authenticated users to bypass role-based access control by visiting a forbidden portal URL multiple times.

Recommendations For versions 9.1(1) and earlier, update to a version that properly handles role restrictions to prevent bypassing of role-based access control.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-0657

Produtos afetados

Cisco Unified Communications Manager

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2014-0657 · Nota de Segurança
• http://securityfocus.com/bid/64690 · Nota
• http://secunia.com/advisories/56368 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0657 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90120 · Nota
• http://tools.cisco.com/security/center/viewAlert.x?alertId=32341 · Aviso do Fabricante
• http://securitytracker.com/id/1029571 · Nota
• http://osvdb.org/101800 · Nota