SQL Injection in Cisco Unified Communications Manager
CVE-2014-0734
SQL injection vulnerability in the Certificate Authority Proxy Function (CAPF) implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum46483.
Vulnerability class: SQL Injection
EPSS: 0.012 (65.1th percentile) — read the EPSS interpretation.
Affected products
- Cisco Unified_communications_manager — versions 3.3\(5\), 3.3\(5\)sr1, 3.3\(5\)sr2a
- N/a — versions n/a
Weakness classification (CWE)
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
- psirt@cisco.com (x_refsource_CONFIRM, Vendor Advisory)
- psirt@cisco.com (vdb-entry, x_refsource_BID)