PT-2014-3804 · Cisco · Cisco Unified Communications Manager

Published 2014-02-27 · Updated 2015-08-01 · CVE-2014-0740

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager (Unified CM) versions 10.0(1) and earlier

Description A cross-site request forgery (CSRF) issue in the Call Detail Records Analysis and Reporting (CAR) interface of the OS Administration component allows remote attackers to hijack the authentication of administrators for requests that make administrative changes.

Recommendations For versions 10.0(1) and earlier, update to a version that contains a fix for this issue to prevent administrative changes from being made by remote attackers.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-0740

Affected Products

Cisco Unified Communications Manager

References · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0740 · Vendor Advisory
• http://tools.cisco.com/security/center/viewAlert.x?alertId=33049 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0740 · Security Note
• http://securitytracker.com/id/1029843 · Note