Auth bypass in Cisco Unified Communications Manager

CVE-2014-0732

The Real Time Monitoring Tool (RTMT) web application in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier does not properly enforce authentication requirements, which allows remote attackers to read application files via a direct request to a URL, aka Bug ID CSCum46495.

Vulnerability class: Broken Authentication

EPSS: 0.018 (76.3th percentile) — read the EPSS interpretation.

Affected products

Cisco Unified_communications_manager — versions 3.3\(5\), 3.3\(5\)sr1, 3.3\(5\)sr2a
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

psirt@cisco.com (x_refsource_CONFIRM, Vendor Advisory)
psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)