VulnerabilityModified
CVE-2014-3279
The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote attackers to enumerate account names via a crafted URL, aka Bug…
MEDIUM 5.0EPSS 2.25%
Does this matter?
Lower severity and a low EPSS score (2.25%). Track it; it rarely justifies an emergency change on its own.
Description
The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote attackers to enumerate account names via a crafted URL, aka Bug IDs CSCun39631 and CSCun39643.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 2.25% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- cisco/unified communications domain manager
- Source
- psirt@cisco.com
References
- http://secunia.com/advisories/58400
- http://secunia.com/advisories/58657
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3279Vendor Advisory
- http://tools.cisco.com/security/center/viewAlert.x?alertId=34381Vendor Advisory
- http://www.securityfocus.com/bid/67663
- http://www.securitytracker.com/id/1030306
- http://secunia.com/advisories/58400
- http://secunia.com/advisories/58657
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3279Vendor Advisory
- http://tools.cisco.com/security/center/viewAlert.x?alertId=34381Vendor Advisory
- http://www.securityfocus.com/bid/67663
- http://www.securitytracker.com/id/1030306
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.