« Volver al listado

CVE-2014-3279

Estado: ModificadaMedia (5)—

The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote attackers to enumerate account names via a crafted URL, aka Bug IDs CSCun39631 and CSCun39643.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cisco — Unified Communications Domain Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-3279",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-05-29T17:55:05.210",
  "references": [
    {
      "url": "http://secunia.com/advisories/58400",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://secunia.com/advisories/58657",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3279",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=34381",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/67663",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1030306",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://secunia.com/advisories/58400",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/58657",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3279",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=34381",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/67663",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1030306",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote attackers to enumerate account names via a crafted URL, aka Bug IDs CSCun39631 and CSCun39643."
    },
    {
      "lang": "es",
      "value": "La interfaz gráfica de usuario (GUI) Administration en el Framewrok web en VOSS en Cisco Unified Communications Domain Manager (CDM) 9.0(.1) y anteriores no implementa debidamente control de acceso, lo que permite a atacantes remotos enumerar nombres de cuentas a través de una URL manipulada, también conocido como Bug IDs CSCun39631 y CSCun39643."
    }
  ],
  "lastModified": "2026-06-17T00:07:53.113",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:unified_communications_domain_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85D5C374-75F5-4738-92ED-EC1A85BBD32D",
              "versionEndIncluding": "9.0\\(.1\\)"
            },
            {
              "criteria": "cpe:2.3:a:cisco:unified_communications_domain_manager:7.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4910F03-9492-4AC2-8204-8EF4F6196E8E"
            },
            {
              "criteria": "cpe:2.3:a:cisco:unified_communications_domain_manager:8.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47308017-16FE-497C-A18A-B6AD39F943DC"
            },
            {
              "criteria": "cpe:2.3:a:cisco:unified_communications_domain_manager:8.6\\(.2\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A8DC4711-3E51-474E-8013-7A76DF916C60"
            },
            {
              "criteria": "cpe:2.3:a:cisco:unified_communications_domain_manager:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AAD0CC9F-3460-40CC-A8DC-8298DEACCAE1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}