PT-2004-1259 · Cisco · Cisco Personal Assistant+1

Published 2004-02-03 · Updated 2017-10-10 · CVE-2004-0044

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Personal Assistant versions 1.4(1) through 1.4(2)

Description The issue allows remote attackers to gain access with a valid username when password authentication is disabled due to specific configuration settings. This occurs when "Allow Only Cisco CallManager Users" is enabled and the Corporate Directory settings refer to the directory service being used by Cisco CallManager.

Recommendations For Cisco Personal Assistant versions 1.4(1) and 1.4(2), consider disabling the "Allow Only Cisco CallManager Users" feature until a patch is available, or ensure that an alternative authentication method is enforced to prevent unauthorized access.

Fix

Related Identifiers

CVE-2004-0044

Affected Products

Cisco Callmanager

Cisco Personal Assistant

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2004-0044 · Security Note
• http://cisco.com/warp/public/707/cisco-sa-20040108-pa.shtml · Vendor Advisory
• http://osvdb.org/3430 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14172 · Note
• http://securityfocus.com/bid/9384 · Note