CVE-2014-3339

2014-08-1223:55:03

CWE-89

[email protected]

web.nvd.nist.gov

cve-2014-3339

sql injection

cisco

cups

admin interface

vulnerability

nvd

bug id cscup74290

8.3 High

AI Score

Confidence

Low

6.5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

61.1%

JSON

Multiple SQL injection vulnerabilities in the administrative web interface in Cisco Unified Communications Manager (CM) and Cisco Unified Presence Server (CUPS) allow remote authenticated users to execute arbitrary SQL commands via crafted input to unspecified pages, aka Bug ID CSCup74290.

Affected configurations

NVD

Node

ciscounified_communications_domain_managerMatch-

ciscounified_presence_server

CPENameOperatorVersion
cisco:unified_communications_domain_managercisco unified communications domain managereq-
cisco:unified_presence_servercisco unified presence servereq*

CPE	Name	Operator	Version
cisco:unified_communications_domain_manager	cisco unified communications domain manager	eq	-
cisco:unified_presence_server	cisco unified presence server	eq	*