CVE-2014-3274
Cisco TelePresence System Software < 6.0.5(5) - Sensitive Directory Information Exposure via HTTPS Fallback
Title source: llmDescription
Cisco TelePresence System (CTS) 6.0(.5)(5) and earlier falls back to HTTP when certain HTTPS sessions cannot be established, which allows man-in-the-middle attackers to obtain sensitive directory information by leveraging a network position between CTS and Cisco Unified Communications Manager (UCM) to block HTTPS traffic, aka Bug ID CSCuj26326.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_confirm
http://tools.cisco.com/security/center/viewAlert.x?alertId=34327
Vendor Advisory vendor-advisory
x_refsource_cisco
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3274
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1030272
Scores
EPSS
0.0113
EPSS Percentile
63.0%
Details
CWE
CWE-310
Status
published
Products (50)
cisco/telepresence_system_software
1.2.3\(1101\)
cisco/telepresence_system_software
1.3.2\(1393\)
cisco/telepresence_system_software
1.4.7\(2229\)
cisco/telepresence_system_software
1.5.1\(2082\)
cisco/telepresence_system_software
1.5.3\(2115\)
cisco/telepresence_system_software
1.5.10\(3648\)
cisco/telepresence_system_software
1.5.11\(3659\)
cisco/telepresence_system_software
1.5.12\(3701\)
cisco/telepresence_system_software
1.5.13\(3717\)
cisco/telepresence_system_software
1.6.0\(3954\)
... and 40 more
Published
May 26, 2014
Tracked Since
Feb 18, 2026