Vulnerability Details : CVE-2014-3339
Multiple SQL injection vulnerabilities in the administrative web interface in Cisco Unified Communications Manager (CM) and Cisco Unified Presence Server (CUPS) allow remote authenticated users to execute arbitrary SQL commands via crafted input to unspecified pages, aka Bug ID CSCup74290.
Vulnerability category: Sql Injection
Exploit prediction scoring system (EPSS) score for CVE-2014-3339
Probability of exploitation activity in the next 30 days: 0.24%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 61 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2014-3339
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST |
CWE ids for CVE-2014-3339
-
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-3339
-
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3339
Cisco Unified Communications Manager and Cisco Unified Presence Server SQL Injection VulnerabilityVendor Advisory
-
http://www.securityfocus.com/bid/69200
Cisco Unified Communications Manager and Unified Presence Server SQL Injection Vulnerability
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/95250
Cisco Unified Communications Manager and Cisco Unified Presence Server SQL injection CVE-2014-3339 Vulnerability Report
Products affected by CVE-2014-3339
- cpe:2.3:a:cisco:unified_presence_server:*:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:unified_communications_domain_manager:-:*:*:*:*:*:*:*