PT-2014-3804 · Cisco · Cisco Unified Communications Manager

Publicado 2014-02-27 · Atualizado 2015-08-01 · CVE-2014-0740

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager (Unified CM) versions 10.0(1) and earlier

Description A cross-site request forgery (CSRF) issue in the Call Detail Records Analysis and Reporting (CAR) interface of the OS Administration component allows remote attackers to hijack the authentication of administrators for requests that make administrative changes.

Recommendations For versions 10.0(1) and earlier, update to a version that contains a fix for this issue to prevent administrative changes from being made by remote attackers.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2014-0740

Produtos afetados

Cisco Unified Communications Manager

Referências · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0740 · Aviso do Fabricante
• http://tools.cisco.com/security/center/viewAlert.x?alertId=33049 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-0740 · Nota de Segurança
• http://securitytracker.com/id/1029843 · Nota