Improper access control

2014-05-2917:55:00

PRIOn knowledge base

www.prio-n.com

7.1 High

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

74.7%

JSON

The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote attackers to enumerate account names via a crafted URL, aka Bug IDs CSCun39631 and CSCun39643.

CPENameOperatorVersion
unified_communications_domain_managereq<= 9.0.1
unified_communications_domain_managereq8.6.2
unified_communications_domain_managereq9.0
unified_communications_domain_managereq8.6
unified_communications_domain_managereq7.4

Name	Operator	Version
unified_communications_domain_manager	eq	<= 9.0.1
unified_communications_domain_manager	eq	8.6.2
unified_communications_domain_manager	eq	9.0
unified_communications_domain_manager	eq	8.6
unified_communications_domain_manager	eq	7.4

References

secunia.com/advisories/58400

secunia.com/advisories/58657

tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3279

tools.cisco.com/security/center/viewAlert.x?alertId=34381

www.securityfocus.com/bid/67663

www.securitytracker.com/id/1030306