CVE-2014-0736
Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) page in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of arbitrary users…
Does this matter?
Lower severity and a low EPSS score (0.97%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) page in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make CAR modifications, aka Bug ID CSCum46468.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 0.97% probability · 60th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- cisco/unified communications manager
- Source
- psirt@cisco.com
References
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0736Vendor Advisory
- http://tools.cisco.com/security/center/viewAlert.x?alertId=32911Vendor Advisory
- http://www.securitytracker.com/id/1029792
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0736Vendor Advisory
- http://tools.cisco.com/security/center/viewAlert.x?alertId=32911Vendor Advisory
- http://www.securitytracker.com/id/1029792
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.