CVE-2014-0740: CSRF
First published: Thu Feb 27 2014(Updated: )
Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) interface in the OS Administration component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of administrators for requests that make administrative changes, aka Bug ID CSCun00701.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unified Communications Manager | <=10.0\(1\) | |
| Cisco Unified Communications Manager | =3.3\(5\) | |
| Cisco Unified Communications Manager | =3.3\(5\)sr1 | |
| Cisco Unified Communications Manager | =3.3\(5\)sr2a | |
| Cisco Unified Communications Manager | =4.1\(3\) | |
| Cisco Unified Communications Manager | =4.1\(3\)sr1 | |
| Cisco Unified Communications Manager | =4.1\(3\)sr2 | |
| Cisco Unified Communications Manager | =4.1\(3\)sr3 | |
| Cisco Unified Communications Manager | =4.1\(3\)sr4 | |
| Cisco Unified Communications Manager | =4.2 | |
| Cisco Unified Communications Manager | =4.2.1 | |
| Cisco Unified Communications Manager | =4.2.2 | |
| Cisco Unified Communications Manager | =4.2.3 | |
| Cisco Unified Communications Manager | =4.2.3sr1 | |
| Cisco Unified Communications Manager | =4.2.3sr2 | |
| Cisco Unified Communications Manager | =4.2.3sr2b | |
| Cisco Unified Communications Manager | =4.3 | |
| Cisco Unified Communications Manager | =10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-0740?
CVE-2014-0740 has been rated as high severity due to its potential for unauthorized access and administrative session hijacking.
How do I fix CVE-2014-0740?
To mitigate CVE-2014-0740, apply the latest security patches provided by Cisco for the affected versions of Unified Communications Manager.
Which Cisco Unified Communications Manager versions are affected by CVE-2014-0740?
CVE-2014-0740 affects Cisco Unified Communications Manager versions 10.0(1) and earlier, including several versions in the 3.x and 4.x series.
What type of vulnerability is CVE-2014-0740?
CVE-2014-0740 is categorized as a cross-site request forgery (CSRF) vulnerability.
Can CVE-2014-0740 be exploited remotely?
Yes, CVE-2014-0740 can be exploited remotely, allowing attackers to hijack the authentication of administrators.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/first-publish-date
- agent/author
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco unified communications manager
- version/cisco unified communications manager/10.0\(1\)
- version/cisco unified communications manager/3.3\(5\)
- version/cisco unified communications manager/3.3\(5\)sr1
- version/cisco unified communications manager/3.3\(5\)sr2a
- version/cisco unified communications manager/4.1\(3\)
- version/cisco unified communications manager/4.1\(3\)sr1
- version/cisco unified communications manager/4.1\(3\)sr2
- version/cisco unified communications manager/4.1\(3\)sr3
- version/cisco unified communications manager/4.1\(3\)sr4
- version/cisco unified communications manager/4.2
- version/cisco unified communications manager/4.2.1
- version/cisco unified communications manager/4.2.2
- version/cisco unified communications manager/4.2.3
- version/cisco unified communications manager/4.2.3sr1
- version/cisco unified communications manager/4.2.3sr2
- version/cisco unified communications manager/4.2.3sr2b
- version/cisco unified communications manager/4.3
- version/cisco unified communications manager/10.0