CVE-2014-3339

Estado: ModificadaMedia (6.5)—

Multiple SQL injection vulnerabilities in the administrative web interface in Cisco Unified Communications Manager (CM) and Cisco Unified Presence Server (CUPS) allow remote authenticated users to execute arbitrary SQL commands via crafted input to unspecified pages, aka Bug ID CSCup74290.

CVSS

Versión: 2.0
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Puntuación base: 6.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 1.54%
Percentil entre todas las CVEs puntuadas: 74
Fecha de la puntuación: 3/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Cisco — Unified Communications Domain Manager Cisco — Unified Presence Server

CWE

CWE-89

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2014-3339",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-08-12T23:55:03.957",
  "references": [
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3339",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/69200",
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95250",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3339",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/69200",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95250",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple SQL injection vulnerabilities in the administrative web interface in Cisco Unified Communications Manager (CM) and Cisco Unified Presence Server (CUPS) allow remote authenticated users to execute arbitrary SQL commands via crafted input to unspecified pages, aka Bug ID CSCup74290."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de inyección SQL en la interfaz del web de administración en Cisco Unified Communications Manager (CM) y Cisco Unified Presence Server (CUPS) permiten a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través de entradas manipuladas en páginas no especificadas, también conocido como Bug ID CSCup74290."
    }
  ],
  "lastModified": "2026-06-17T00:08:00.867",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:unified_communications_domain_manager:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FAC05C99-071F-47E7-A3B6-899488520663"
            },
            {
              "criteria": "cpe:2.3:a:cisco:unified_presence_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D3C9AF1-A2BF-4F56-BE38-ED6DC45E94E7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}