CVE-2014-0740
Summary
| CVE | CVE-2014-0740 |
|---|---|
| State | PUBLISHED |
| Assigner | cisco |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-02-27 01:55:03 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) interface in the OS Administration component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of administrators for requests that make administrative changes, aka Bug ID CSCun00701. |
Risk And Classification
Primary CVSS: v2.0 6.8 from [email protected]
AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS: 0.001260000 probability, percentile 0.313370000 (date 2026-05-05)
Problem Types: CWE-352 | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:M/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Cisco | Unified Communications Manager | 10.0 | All | All | All |
| Application | Cisco | Unified Communications Manager | 3.3\(5\) | All | All | All |
| Application | Cisco | Unified Communications Manager | 3.3\(5\)sr1 | All | All | All |
| Application | Cisco | Unified Communications Manager | 3.3\(5\)sr2a | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.1\(3\) | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.1\(3\)sr1 | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.1\(3\)sr2 | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.1\(3\)sr3 | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.1\(3\)sr4 | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.2 | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.2.1 | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.2.2 | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.2.3 | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.2.3sr1 | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.2.3sr2 | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.2.3sr2b | All | All | All |
| Application | Cisco | Unified Communications Manager | 4.3 | All | All | All |
| Application | Cisco | Unified Communications Manager | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Cisco Unified Communications Manager OS Administration CSRF Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | tools.cisco.com | Vendor Advisory |
| Cisco Unified Communications Manager OS Administration CSRF Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | tools.cisco.com | Vendor Advisory |
| Cisco Unified Communications Manager Bugs Let Remote Users Modify System Data and Conduct Cross-Site Request Forgery Attacks and Let Local Users Gain Elevated Privileges - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.