CVE-2014-3279

The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote attackers to enumerate account names via a crafted URL, aka Bug IDs CSCun39631 and CSCun39643.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3279	Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=34381	Vendor Advisory
http://secunia.com/advisories/58400
http://www.securitytracker.com/id/1030306
http://www.securityfocus.com/bid/67663
http://secunia.com/advisories/58657

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:unified_communications_domain_manager::::::::
	cpe:2.3:a:cisco:unified_communications_domain_manager:8.6\(.2\):::::::*
	cpe:2.3:a:cisco:unified_communications_domain_manager:7.4:::::::*
	cpe:2.3:a:cisco:unified_communications_domain_manager:9.0:::::::*
	cpe:2.3:a:cisco:unified_communications_domain_manager:8.6:::::::*

Information

Published : 2014-05-29 10:55

Updated : 2015-12-04 10:43

NVD link : CVE-2014-3279

Mitre link : CVE-2014-3279

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Advertisement

Products Affected

cisco

unified_communications_domain_manager

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3279", "name": "20140527 Cisco Unified Communications Domain Manager Admin User Enumeration Vulnerability", "tags": ["Vendor Advisory"], "refsource": "CISCO"}, {"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=34381", "name": "http://tools.cisco.com/security/center/viewAlert.x?alertId=34381", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://secunia.com/advisories/58400", "name": "58400", "tags": [], "refsource": "SECUNIA"}, {"url": "http://www.securitytracker.com/id/1030306", "name": "1030306", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.securityfocus.com/bid/67663", "name": "67663", "tags": [], "refsource": "BID"}, {"url": "http://secunia.com/advisories/58657", "name": "58657", "tags": [], "refsource": "SECUNIA"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote attackers to enumerate account names via a crafted URL, aka Bug IDs CSCun39631 and CSCun39643."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-3279", "ASSIGNER": "psirt@cisco.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2014-05-29T17:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:cisco:unified_communications_domain_manager:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "9.0\\(.1\\)"}, {"cpe23Uri": "cpe:2.3:a:cisco:unified_communications_domain_manager:8.6\\(.2\\):*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:cisco:unified_communications_domain_manager:7.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:cisco:unified_communications_domain_manager:9.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:cisco:unified_communications_domain_manager:8.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2015-12-04T18:43Z"}