Vulnslist

find the latest Cisco vulnerabilities

Cisco Unity Connection SQL Injection Vulnerability

Cisco-SA-20140811-CVE-2014-3336 · Medium · Published · Updated

A vulnerability in the web framework code of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary queries on the database. The vulnerability is due to insufficient controls on Structured Query Language (SQL) statements. An attacker could exploit this vulnerability by sending crafted requests to the web server. An exploit could allow the attacker to read a subset of the data stored in the database. Cisco has confirmed the vulnerability in a security notice; however, software updates are not available. To exploit this vulnerability, an attacker must authenticate to the targeted device. This access requirement may reduce the likelihood of a successful exploit. Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.

Cisco advisory ·CSAF JSON

Workarounds

Administrators are advised to contact the vendor regarding future updates and releases.

Administrators are advised to allow only trusted users to have network access.

Administrators are advised to allow only privileged users to access administration or management systems.

For additional information about SQL injection attacks and defenses, see Understanding SQL Injectionhttp://www.cisco.com/web/about/security/intelligence/sql_injection.html .

Administrators are advised to monitor affected systems.

CVEsCVE-2014-3336
Cisco Bug IDsCSCuq31016
CVSS ScoreBase 4.0
Base 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N/E:F/RL:U/RC:C
Product Names From Source
Cisco Unity Connection

Related Products

Product CVE Evidence
Cisco Unity CVE-2014-3336 Cisco OpenVuln
Cisco Unity Connection CVE-2014-3336 Cisco OpenVuln