CVE-2014-8000: Medium severity cisco unified communications manager im and presence vulnerability

Published Nov 21, 2014

Updated

Cisco Unified Communications Manager IM and Presence Service 9.1(1) produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requests, aka Bug ID CSCur63497.

Affected Software

1 affected component

Cisco Unified Communications Manager IM and Presence Service=9.1\(1\)

Event History

Nov 21, 2014

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-8000?

CVE-2014-8000 is classified as a medium severity vulnerability.

How do I fix CVE-2014-8000?

To mitigate CVE-2014-8000, upgrade to a patched version of Cisco Unified Communications Manager IM and Presence Service beyond 9.1(1).

What does CVE-2014-8000 allow attackers to do?

CVE-2014-8000 allows remote attackers to enumerate user accounts through differential responses to URL requests.

Which software is affected by CVE-2014-8000?

CVE-2014-8000 specifically affects Cisco Unified Communications Manager IM and Presence Service version 9.1(1).

Is there a workaround for CVE-2014-8000?

There are no known workarounds for CVE-2014-8000 other than applying the necessary software updates.