CVE-2014-3333
First published: Mon Aug 11 2014(Updated: )
The server in Cisco Unity Connection 9.1(1) and 9.1(2) allows remote authenticated users to obtain privileged access by conducting an "HTTP Intercept" attack and leveraging the ability to read files within the context of the web-server user account, aka Bug ID CSCup41014.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unity Connection | =9.1\(1\) | |
| Cisco Unity Connection | =9.1\(2\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/59768
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3333
- http://tools.cisco.com/security/center/viewAlert.x?alertId=35200
- http://www.securityfocus.com/bid/69074
- http://www.securitytracker.com/id/1030688
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95135
Frequently Asked Questions
What is the severity of CVE-2014-3333?
CVE-2014-3333 has been classified with a CVSS score indicating a high severity level due to the potential for privilege escalation.
How do I fix CVE-2014-3333?
To address CVE-2014-3333, it is recommended to upgrade to a non-vulnerable version of Cisco Unity Connection, specifically versions beyond 9.1(2).
Can CVE-2014-3333 be exploited remotely?
Yes, CVE-2014-3333 can be exploited remotely by authenticated users through an HTTP intercept attack.
What kind of access does CVE-2014-3333 provide attackers?
CVE-2014-3333 allows attackers to obtain privileged access and read files within the context of the web-server user account.
Which versions of Cisco Unity Connection are affected by CVE-2014-3333?
CVE-2014-3333 affects Cisco Unity Connection versions 9.1(1) and 9.1(2).
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- vendor/cisco
- canonical/cisco unity connection
- version/cisco unity connection/9.1\(1\)
- version/cisco unity connection/9.1\(2\)