6.8
CVE-2014-0740
- EPSS 0.98%
- Veröffentlicht 27.02.2014 01:55:03
- Zuletzt bearbeitet 29.04.2026 01:13:23
- Quelle psirt@cisco.com
- CVE-Watchlists
- Unerledigt
LoginCross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) interface in the OS Administration component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of administrators for requests that make administrative changes, aka Bug ID CSCun00701.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Unified Communications Manager Version <= 10.0\(1\)
Cisco ≫ Unified Communications Manager Version4.2
Cisco ≫ Unified Communications Manager Version4.2.1
Cisco ≫ Unified Communications Manager Version4.2.2
Cisco ≫ Unified Communications Manager Version4.2.3
Cisco ≫ Unified Communications Manager Version4.2.3sr1
Cisco ≫ Unified Communications Manager Version4.2.3sr2
Cisco ≫ Unified Communications Manager Version4.2.3sr2b
Cisco ≫ Unified Communications Manager Version4.3
Cisco ≫ Unified Communications Manager Version10.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.98% | 0.577 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.8 | 8.6 | 6.4 |
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0740
http://tools.cisco.com/security/center/viewAlert.x?alertId=33049
http://www.securitytracker.com/id/1029843