Unscored severity · published May 29, 2014
CVE-2014-3277
The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which…
–
CVSS
2.1%
EPSS
No
On KEV
Description
The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote authenticated users to obtain sensitive user and group information by leveraging Location Administrator privileges and entering a crafted URL, aka Bug ID CSCum77005.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UC
Unified Communications Domain Manager · Cisco
through 9.0\(.1\); 7.4; 8.6; 8.6(.2); 9.0 · source: NVD
Affected product
UC
Unified Communications Domain Manager
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3277
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3277
secunia.com
http://secunia.com/advisories/58400
Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3277
Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=34380
Third Party Advisory
http://www.securityfocus.com/bid/67664
Third Party Advisory
http://www.securitytracker.com/id/1030306
More from Unified Communications Domain Manager
9.8
CVE-2018-0124
A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypass security protections, gain elevated privileges, and…
8.8
CVE-2018-0364
A vulnerability in the web-based management interface of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to conduct a cross-site…
6.1
CVE-2018-0386
A vulnerability in Cisco Unified Communications Domain Manager Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on an…
6.1
CVE-2017-6670
A vulnerability in the web-based GUI of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka…
6.1
CVE-2016-1354
Cross-site scripting (XSS) vulnerability in Cisco Unified Communications Domain Manager (UCDM) 8.x before 8.1.1 allows remote attackers to inject arbitrary web script or HTML via…