CVE-2014-7988
published 2014-11-07CVE-2014-7988: The Unified Messaging Service (UMS) in Cisco Unity Connection 10.5 and earlier allows remote authenticated users to obtain sensitive information by reading log…
PriorityP418medium4CVSS 2.0
AVNACLAuSCPINAN
EPSS
1.64%
73.9th percentile
The Unified Messaging Service (UMS) in Cisco Unity Connection 10.5 and earlier allows remote authenticated users to obtain sensitive information by reading log files, aka Bug ID CSCur06493.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | unity_connection | <= 10.5 | — |
CVSS provenance
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_cisco4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-449v-9r3c-5w53: The Unified Messaging Service (UMS) in Cisco Unity Connection 10
ghsa_unreviewed·2022-05-17
CVE-2014-7988 [MEDIUM] CWE-200 GHSA-449v-9r3c-5w53: The Unified Messaging Service (UMS) in Cisco Unity Connection 10
The Unified Messaging Service (UMS) in Cisco Unity Connection 10.5 and earlier allows remote authenticated users to obtain sensitive information by reading log files, aka Bug ID CSCur06493.
Cisco
Cisco Unity Connection Information Disclosure Vulnerability
vendor_cisco·2014-11-05·CVSS 4.0
CVE-2014-7988 [MEDIUM] CWE-200 Cisco Unity Connection Information Disclosure Vulnerability
Cisco Unity Connection Information Disclosure Vulnerability
A vulnerability in the Unified Messaging Service (UMS) of Cisco Unity Connection, could allow an authenticated, remote attacker to access sensitive information.
The vulnerability is due to the inclusion of sensitive information in the logs. An attacker could exploit this vulnerability by viewing the sensitive information stored in the vulnerable logs.
Cisco has confirmed the vulnerability in a security notice and released software updates.
To exploit this vulnerability, an attacker must authenticate to a targeted device. This access requirement may reduce the likelihood of a successful exploit.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://secunia.com/advisories/62106http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7988http://tools.cisco.com/security/center/viewAlert.x?alertId=36340http://www.securitytracker.com/id/1031177https://exchange.xforce.ibmcloud.com/vulnerabilities/98493http://secunia.com/advisories/62106http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7988http://tools.cisco.com/security/center/viewAlert.x?alertId=36340http://www.securitytracker.com/id/1031177https://exchange.xforce.ibmcloud.com/vulnerabilities/98493
2014-11-07
Published