CVE-2014-0735
Summary
| CVE | CVE-2014-0735 |
|---|---|
| State | PUBLISHED |
| Assigner | cisco |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-02-20 05:18:04 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | Cross-site scripting (XSS) vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum46470. |
Risk And Classification
Primary CVSS: v2.0 4.3 from [email protected]
AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS: 0.002770000 probability, percentile 0.510570000 (date 2026-05-05)
Problem Types: CWE-79 | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Cisco | Unified Communications Manager | 10.0 | All | All | All |
| Application | Cisco | Unified Communications Manager | 3.3\(5\) | All | All | All |
| Application | Cisco | Unified Communications Manager | 3.3\(5\)sr1 | All | All | All |
| Application | Cisco | Unified Communications Manager | 3.3\(5\)sr2a | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.1\(3\) | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.1\(3\)sr1 | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.1\(3\)sr2 | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.1\(3\)sr3 | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.1\(3\)sr4 | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.2 | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.2.1 | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.2.2 | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.2.3 | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.2.3sr1 | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.2.3sr2 | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.2.3sr2b | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.3 | All | All | All |
| Application | Cisco | Unified Communications Manager | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Cisco Unified Communications Manager IPMA Reflected Cross-Site Scripting Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | tools.cisco.com | Vendor Advisory |
| Cisco Unified Communications Manager Input Validation Flaw in IPMA Interface Permits Cross-Site Scripting Attacks - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| Cisco Unified Communications Manager IPMA Cross Site Scripting Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Cisco Unified Communications Manager IPMA Reflected Cross-Site Scripting Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | tools.cisco.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.