CVE-2014-0740

Cisco Unified Communications Manager < 10.0(1) - Cross-Site Request Forgery in CAR Interface

Title source: llm

Description

Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) interface in the OS Administration component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of administrators for requests that make administrative changes, aka Bug ID CSCun00701.

References (3)

Core 3

Core References

Vendor Advisory x_refsource_confirm

http://tools.cisco.com/security/center/viewAlert.x?alertId=33049

Vendor Advisory vendor-advisory x_refsource_cisco

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0740

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1029843

Scores

EPSS 0.0098

EPSS Percentile 58.1%

Details

CWE

CWE-352

Status published

Products (18)

cisco/unified_communications_manager 3.3\(5\)

cisco/unified_communications_manager 3.3\(5\)sr1

cisco/unified_communications_manager 3.3\(5\)sr2a

cisco/unified_communications_manager 4.1\(3\)

cisco/unified_communications_manager 4.1\(3\)sr1

cisco/unified_communications_manager 4.1\(3\)sr2

cisco/unified_communications_manager 4.1\(3\)sr3

cisco/unified_communications_manager 4.1\(3\)sr4

cisco/unified_communications_manager 4.2

cisco/unified_communications_manager 4.2.1

... and 8 more

Published Feb 27, 2014

Tracked Since Feb 18, 2026