Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-0657

The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly handle role restrictions, which allows remote authenticated users to bypass role-based access control via multiple visits to a forbidden portal URL, aka Bug ID CSCuj83540.

Published

2014-01-08T21:55:06.410

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.0 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

8.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-264

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	cisco	unified_communications_manager	≤ 9.1\(1\)	Yes
Application	cisco	unified_communications_manager	3.3\(5\)	Yes
Application	cisco	unified_communications_manager	3.3\(5\)sr1	Yes
Application	cisco	unified_communications_manager	3.3\(5\)sr2a	Yes
Application	cisco	unified_communications_manager	4.1\(3\)	Yes
Application	cisco	unified_communications_manager	4.1\(3\)sr1	Yes
Application	cisco	unified_communications_manager	4.1\(3\)sr2	Yes
Application	cisco	unified_communications_manager	4.1\(3\)sr3	Yes
Application	cisco	unified_communications_manager	4.1\(3\)sr4	Yes
Application	cisco	unified_communications_manager	4.2	Yes
Application	cisco	unified_communications_manager	4.2.1	Yes
Application	cisco	unified_communications_manager	4.2.2	Yes
Application	cisco	unified_communications_manager	4.2.3	Yes
Application	cisco	unified_communications_manager	4.2.3sr1	Yes
Application	cisco	unified_communications_manager	4.2.3sr2	Yes
Application	cisco	unified_communications_manager	4.2.3sr2b	Yes
Application	cisco	unified_communications_manager	4.3	Yes
Application	cisco	unified_communications_manager	4.3\(1\)	Yes
Application	cisco	unified_communications_manager	5.0	Yes
Application	cisco	unified_communications_manager	5.1	Yes
Application	cisco	unified_communications_manager	5.1\(1\)	Yes
Application	cisco	unified_communications_manager	5.1\(1b\)	Yes
Application	cisco	unified_communications_manager	5.1\(1c\)	Yes
Application	cisco	unified_communications_manager	5.1\(2\)	Yes
Application	cisco	unified_communications_manager	5.1\(2a\)	Yes
Application	cisco	unified_communications_manager	5.1\(2b\)	Yes
Application	cisco	unified_communications_manager	5.1\(3\)	Yes
Application	cisco	unified_communications_manager	5.1\(3a\)	Yes
Application	cisco	unified_communications_manager	5.1\(3c\)	Yes
Application	cisco	unified_communications_manager	5.1\(3d\)	Yes
Application	cisco	unified_communications_manager	5.1\(3e\)	Yes
Application	cisco	unified_communications_manager	5.1.2	Yes
Application	cisco	unified_communications_manager	6.0	Yes
Application	cisco	unified_communications_manager	6.0\(1\)	Yes
Application	cisco	unified_communications_manager	6.0\(1a\)	Yes
Application	cisco	unified_communications_manager	6.0\(1b\)	Yes
Application	cisco	unified_communications_manager	6.1\(1\)	Yes
Application	cisco	unified_communications_manager	6.1\(1a\)	Yes
Application	cisco	unified_communications_manager	6.1\(1b\)	Yes
Application	cisco	unified_communications_manager	6.1\(2\)	Yes
Application	cisco	unified_communications_manager	6.1\(2\)su1	Yes
Application	cisco	unified_communications_manager	6.1\(2\)su1a	Yes
Application	cisco	unified_communications_manager	6.1\(3\)	Yes
Application	cisco	unified_communications_manager	6.1\(3a\)	Yes
Application	cisco	unified_communications_manager	6.1\(3b\)	Yes
Application	cisco	unified_communications_manager	6.1\(3b\)su1	Yes
Application	cisco	unified_communications_manager	6.1\(4\)	Yes
Application	cisco	unified_communications_manager	6.1\(4\)su1	Yes
Application	cisco	unified_communications_manager	6.1\(4a\)	Yes
Application	cisco	unified_communications_manager	6.1\(4a\)su2	Yes
Application	cisco	unified_communications_manager	6.1\(5\)	Yes
Application	cisco	unified_communications_manager	6.1\(5\)su1	Yes
Application	cisco	unified_communications_manager	6.1\(5\)su2	Yes
Application	cisco	unified_communications_manager	6.1\(5\)su3	Yes
Application	cisco	unified_communications_manager	7.0\(1\)su1	Yes
Application	cisco	unified_communications_manager	7.0\(1\)su1a	Yes
Application	cisco	unified_communications_manager	7.0\(2\)	Yes
Application	cisco	unified_communications_manager	7.0\(2a\)	Yes
Application	cisco	unified_communications_manager	7.0\(2a\)su1	Yes
Application	cisco	unified_communications_manager	7.0\(2a\)su2	Yes
Application	cisco	unified_communications_manager	7.1\(2a\)	Yes
Application	cisco	unified_communications_manager	7.1\(2a\)su1	Yes
Application	cisco	unified_communications_manager	7.1\(2b\)	Yes
Application	cisco	unified_communications_manager	7.1\(2b\)su1	Yes
Application	cisco	unified_communications_manager	7.1\(3\)	Yes
Application	cisco	unified_communications_manager	7.1\(3a\)	Yes
Application	cisco	unified_communications_manager	7.1\(3a\)su1	Yes
Application	cisco	unified_communications_manager	7.1\(3a\)su1a	Yes
Application	cisco	unified_communications_manager	7.1\(3b\)	Yes
Application	cisco	unified_communications_manager	7.1\(3b\)su1	Yes
Application	cisco	unified_communications_manager	7.1\(3b\)su2	Yes
Application	cisco	unified_communications_manager	7.1\(5\)	Yes
Application	cisco	unified_communications_manager	7.1\(5\)su1	Yes
Application	cisco	unified_communications_manager	7.1\(5\)su1a	Yes
Application	cisco	unified_communications_manager	7.1\(5a\)	Yes
Application	cisco	unified_communications_manager	7.1\(5b\)	Yes
Application	cisco	unified_communications_manager	7.1\(5b\)su1	Yes
Application	cisco	unified_communications_manager	7.1\(5b\)su1a	Yes
Application	cisco	unified_communications_manager	7.1\(5b\)su2	Yes
Application	cisco	unified_communications_manager	7.1\(5b\)su3	Yes
Application	cisco	unified_communications_manager	7.1\(5b\)su4	Yes
Application	cisco	unified_communications_manager	7.1\(5b\)su5	Yes
Application	cisco	unified_communications_manager	7.1\(5b\)su6	Yes
Application	cisco	unified_communications_manager	8.0	Yes
Application	cisco	unified_communications_manager	8.0\(1\)	Yes
Application	cisco	unified_communications_manager	8.0\(2\)	Yes
Application	cisco	unified_communications_manager	8.0\(2a\)	Yes
Application	cisco	unified_communications_manager	8.0\(2b\)	Yes
Application	cisco	unified_communications_manager	8.0\(2c\)	Yes
Application	cisco	unified_communications_manager	8.0\(2c\)su1	Yes
Application	cisco	unified_communications_manager	8.0\(3\)	Yes
Application	cisco	unified_communications_manager	8.0\(3a\)	Yes
Application	cisco	unified_communications_manager	8.0\(3a\)su1	Yes
Application	cisco	unified_communications_manager	8.0\(3a\)su2	Yes
Application	cisco	unified_communications_manager	8.0\(3a\)su3	Yes
Application	cisco	unified_communications_manager	8.5	Yes
Application	cisco	unified_communications_manager	8.5\(1\)	Yes
Application	cisco	unified_communications_manager	8.5\(1\)su1	Yes
Application	cisco	unified_communications_manager	8.5\(1\)su2	Yes
Application	cisco	unified_communications_manager	8.5\(1\)su3	Yes
Application	cisco	unified_communications_manager	8.5\(1\)su4	Yes
Application	cisco	unified_communications_manager	8.5\(1\)su5	Yes
Application	cisco	unified_communications_manager	8.6	Yes
Application	cisco	unified_communications_manager	8.6\(1\)	Yes
Application	cisco	unified_communications_manager	8.6\(1a\)	Yes
Application	cisco	unified_communications_manager	8.6\(2\)	Yes
Application	cisco	unified_communications_manager	8.6\(2a\)	Yes
Application	cisco	unified_communications_manager	8.6\(2a\)su1	Yes
Application	cisco	unified_communications_manager	8.6\(2a\)su2	Yes
Application	cisco	unified_communications_manager	8.6\(2a\)su3	Yes
Application	cisco	unified_communications_manager	8.6\(3\)	Yes
Application	cisco	unified_communications_manager	8.6\(4\)	Yes
Application	cisco	unified_communications_manager	9.0\(1\)	Yes

References

http://osvdb.org/101800 ([email protected])
http://secunia.com/advisories/56368 ([email protected])
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0657 Vendor Advisory ([email protected])
http://tools.cisco.com/security/center/viewAlert.x?alertId=32341 Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/64690 Third Party Advisory, VDB Entry ([email protected])
http://www.securitytracker.com/id/1029571 Third Party Advisory, VDB Entry ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/90120 ([email protected])
http://osvdb.org/101800 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/56368 (af854a3a-2127-422b-91ae-364da2661108)
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0657 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://tools.cisco.com/security/center/viewAlert.x?alertId=32341 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/64690 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id/1029571 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/90120 (af854a3a-2127-422b-91ae-364da2661108)