CVE-2014-3336: SQL Injection
Published Aug 11, 2014
·Updated
SQL injection vulnerability in the web framework in Cisco Unity Connection 9.1(2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted request, aka Bug ID CSCuq31016.
Affected Software
2 affected components
Cisco Unity Connection=9.1\(1\)
Cisco Unity Connection=9.1\(2\)
Event History
Aug 11, 2014
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-3336?
CVE-2014-3336 has a high severity rating due to the potential for unauthorized SQL command execution.
2
How do I fix CVE-2014-3336?
To address CVE-2014-3336, upgrade to Cisco Unity Connection version 9.1(3) or later.
3
Who is affected by CVE-2014-3336?
CVE-2014-3336 affects users of Cisco Unity Connection versions 9.1(1) and 9.1(2) that are remote authenticated.
4
What type of vulnerability is CVE-2014-3336?
CVE-2014-3336 is classified as an SQL injection vulnerability.
5
Can CVE-2014-3336 be exploited remotely?
Yes, CVE-2014-3336 can be exploited by remote authenticated users.