CVE-2014-0728
published 2014-02-13CVE-2014-0728: SQL injection vulnerability in the Java database interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute…
PriorityP345high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
1.96%
78.3th percentile
SQL injection vulnerability in the Java database interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05313.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | unified_communications_manager | <= 10.0\(1\) | — |
| cisco | unified_communications_manager | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_cisco7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Unified Communications Manager Java Interface SQL Injection Vulnerability
vendor_cisco·2014-07-11·CVSS 7.5
CVE-2014-0728 [HIGH] CWE-89 Cisco Unified Communications Manager Java Interface SQL Injection Vulnerability
Cisco Unified Communications Manager Java Interface SQL Injection Vulnerability
A
vulnerability in the Java database interface of Cisco Unified Communications
Manager (Cisco Unified CM) could allow an unauthenticated, remote attacker to
impact the integrity of the system by executing arbitrary SQL queries.
The vulnerability is due to a failure to validate user-supplied input
used in SQL queries. An attacker could exploit this vulnerability by
sending crafted URLs that include SQL statements. An exploit could allow
the attacker to determine the presence of certain values in the
database.
Cisco has confirmed the vulnerability in a security notice and released software updates.
Although Cisco indicates through the CVSS score that software updates are not available, software updates are a
GHSA
GHSA-j2x5-69mm-hfg9: SQL injection vulnerability in the Java database interface in Cisco Unified Communications Manager (UCM) 10
ghsa_unreviewed·2022-05-17
CVE-2014-0728 [HIGH] CWE-89 GHSA-j2x5-69mm-hfg9: SQL injection vulnerability in the Java database interface in Cisco Unified Communications Manager (UCM) 10
SQL injection vulnerability in the Java database interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05313.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://osvdb.org/103221http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0728http://tools.cisco.com/security/center/viewAlert.x?alertId=32834http://www.securityfocus.com/bid/65499http://osvdb.org/103221http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0728http://tools.cisco.com/security/center/viewAlert.x?alertId=32834http://www.securityfocus.com/bid/65499
2014-02-13
Published