CVE-2014-0747 — Improper Input Validation in Cisco Unified Communications Manager

CWE-20 — Improper Input Validation CWE-78 — OS Command Injection4 documents4 sources

Severity

6.8MEDIUMNVD

EPSS

0.0%

top 85.14%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Unified Communications Manager

Timeline

PublishedFeb 27

Latest updateMay 17

Description

The Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to inject commands via unspecified CAPF programs, aka Bug ID CSCum95493.

CVSS vector

AV:L/AC:L/C:C/I:C/A:CExploitability: 3.1 | Impact: 10.0

Affected Packages1 packages

▶NVDcisco/unified_communications_manager10.0\(1\)+17

🔴Vulnerability Details

GHSA

GHSA-pr76-46qc-55q8: The Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10↗2022-05-17

▶

CVEList

CVE-2014-0747: The Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10↗2014-02-27

▶

📋Vendor Advisories

Cisco

Cisco Unified Communications Manager CAPF CLI Command Injection Vulnerability↗2014-02-26

▶