SQL Injection in Cisco Unified Communications Domain Manager
CVE-2014-3339
Multiple SQL injection vulnerabilities in the administrative web interface in Cisco Unified Communications Manager (CM) and Cisco Unified Presence Server (CUPS) allow remote authenticated users to execute arbitrary SQL commands via crafted input to unspecified pages, aka Bug ID CSCup74290.
Vulnerability class: SQL Injection
EPSS: 0.015 (73.5th percentile) — read the EPSS interpretation.
Affected products
- Cisco Unified_communications_domain_manager
- Cisco Unified_presence_server
- N/a — versions n/a
Weakness classification (CWE)
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
- psirt@cisco.com (vdb-entry, x_refsource_BID)
- psirt@cisco.com (vdb-entry, x_refsource_XF)