CVE-2014-2125

Status: ModifiedMedium (4.3)—

Cross-site scripting (XSS) vulnerability in the Web Inbox in Cisco Unity Connection 8.6(2a)SU3 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui33028.

CVSS

Version: 2.0
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Base score: 4.3

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 1.15%
Percentile among all scored CVEs: 66
Score date: 10/6/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Cisco — Unity Connection

CWEs

CWE-79

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2014-2125",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-04-02T03:58:17.090",
  "references": [
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2125",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=33603",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1029988",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2125",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=33603",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1029988",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in the Web Inbox in Cisco Unity Connection 8.6(2a)SU3 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui33028."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de XSS en Web Inbox de Cisco Unity Connection 8.6(2a)SU3 y anteriores permite a atacantes remotos inyectar script Web o HTML arbitrarios a través de un parámetro no especificado, también conocido como Bug ID CSCui33028."
    }
  ],
  "lastModified": "2026-06-17T00:06:06.303",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:unity_connection:*:\\(2a\\)su3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52D449F3-D3EF-4711-B5B1-0E6DC17ED20C",
              "versionEndIncluding": "8.6"
            },
            {
              "criteria": "cpe:2.3:a:cisco:unity_connection:8.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62C504A3-5B4C-4230-97A9-B3CCDA0CBD31"
            },
            {
              "criteria": "cpe:2.3:a:cisco:unity_connection:8.6:\\(1\\):*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3285A9DA-81A3-4E57-93E6-BCC54FFE3661"
            },
            {
              "criteria": "cpe:2.3:a:cisco:unity_connection:8.6:\\(2\\):*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3E5E101-6E83-492D-8034-FF435BB92B5E"
            },
            {
              "criteria": "cpe:2.3:a:cisco:unity_connection:8.6:\\(2a\\)su1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "53861756-06E5-42EF-8E6F-06C21AB92313"
            },
            {
              "criteria": "cpe:2.3:a:cisco:unity_connection:8.6:\\(2a\\)su2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB4C6D85-B322-4C4B-8B4D-6BB2A433A09A"
            },
            {
              "criteria": "cpe:2.3:a:cisco:unity_connection:8.6\\(1a\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C40F61A6-A992-4DA4-9730-D145055596C2"
            },
            {
              "criteria": "cpe:2.3:a:cisco:unity_connection:8.6\\(2a\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "632B8CDD-5ACC-4FFB-950B-480CC43D192D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}