VulnerabilityModified
CVE-2014-3339
Multiple SQL injection vulnerabilities in the administrative web interface in Cisco Unified Communications Manager (CM) and Cisco Unified Presence Server (CUPS) allow remote authenticated users to execute arbitrary SQL commands via crafted input to…
MEDIUM 6.5EPSS 1.54%
Does this matter?
Lower severity and a low EPSS score (1.54%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple SQL injection vulnerabilities in the administrative web interface in Cisco Unified Communications Manager (CM) and Cisco Unified Presence Server (CUPS) allow remote authenticated users to execute arbitrary SQL commands via crafted input to unspecified pages, aka Bug ID CSCup74290.
- CVSS 2.0
- 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
- EPSS
- 1.54% probability · 73th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- cisco/unified communications domain manager · cisco/unified presence server
- Source
- psirt@cisco.com
References
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3339Vendor Advisory
- http://www.securityfocus.com/bid/69200
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95250
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3339Vendor Advisory
- http://www.securityfocus.com/bid/69200
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95250
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.