CVE-2014-0742 — Improper Input Validation in Cisco Unified Communications Manager

CWE-20 — Improper Input Validation4 documents4 sources

Severity

6.2MEDIUMNVD

EPSS

0.0%

top 89.46%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Unified Communications Manager

Timeline

PublishedFeb 27

Latest updateMay 17

Description

The Certificate Authority Proxy Function (CAPF) CLI implementation in the CSR management feature in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to read or modify arbitrary files via unspecified vectors, aka Bug ID CSCum95464.

CVSS vector

AV:L/AC:L/C:C/I:C/A:NExploitability: 3.1 | Impact: 9.2

Affected Packages1 packages

▶NVDcisco/unified_communications_manager10.0\(1\)+17

🔴Vulnerability Details

GHSA

GHSA-pmwj-966p-qvv8: The Certificate Authority Proxy Function (CAPF) CLI implementation in the CSR management feature in Cisco Unified Communications Manager (Unified CM)↗2022-05-17

▶

CVEList

CVE-2014-0742: The Certificate Authority Proxy Function (CAPF) CLI implementation in the CSR management feature in Cisco Unified Communications Manager (Unified CM)↗2014-02-27

▶

📋Vendor Advisories

Cisco

Cisco Unified Communications Manager CAPF CSR Arbitrary File Read/Write Vulnerability↗2014-02-25

▶