{"api_version":"1","generated_at":"2026-07-23T05:46:15+00:00","cve":"CVE-2014-2125","urls":{"html":"https://cve.report/CVE-2014-2125","api":"https://cve.report/api/cve/CVE-2014-2125.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-2125","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-2125"},"summary":{"title":"CVE-2014-2125","description":"Cross-site scripting (XSS) vulnerability in the Web Inbox in Cisco Unity Connection 8.6(2a)SU3 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui33028.","state":"PUBLISHED","assigner":"cisco","published_at":"2014-04-02 03:58:17","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=33603","name":"http://tools.cisco.com/security/center/viewAlert.x?alertId=33603","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Cisco Unity Connection Cross-Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1029988","name":"http://www.securitytracker.com/id/1029988","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Cisco Unity Connection Input Validation Hole in Web Inbox Permits Cross-Site Scripting Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2125","name":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2125","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Cisco Unity Connection Cross-Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-2125","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2125","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"2125","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"unity_connection","cpe6":"8.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2125","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"unity_connection","cpe6":"8.6","cpe7":"\\(1\\)","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2125","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"unity_connection","cpe6":"8.6","cpe7":"\\(2a\\)su1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2125","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"unity_connection","cpe6":"8.6","cpe7":"\\(2a\\)su2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2125","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"unity_connection","cpe6":"8.6","cpe7":"\\(2\\)","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2125","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"unity_connection","cpe6":"8.6\\(1a\\)","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2125","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"unity_connection","cpe6":"8.6\\(2a\\)","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2125","vulnerable":"1","versionEndIncluding":"8.6","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"unity_connection","cpe6":"*","cpe7":"\\(2a\\)su3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T10:05:59.885Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"1029988","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1029988"},{"name":"20140401 Cisco Unity Connection Cross-Site Scripting Vulnerability","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"],"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2125"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=33603"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-04-01T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in the Web Inbox in Cisco Unity Connection 8.6(2a)SU3 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui33028."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2015-05-04T16:57:01.000Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco"},"references":[{"name":"1029988","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1029988"},{"name":"20140401 Cisco Unity Connection Cross-Site Scripting Vulnerability","tags":["vendor-advisory","x_refsource_CISCO"],"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2125"},{"tags":["x_refsource_CONFIRM"],"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=33603"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@cisco.com","ID":"CVE-2014-2125","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in the Web Inbox in Cisco Unity Connection 8.6(2a)SU3 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui33028."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"1029988","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1029988"},{"name":"20140401 Cisco Unity Connection Cross-Site Scripting Vulnerability","refsource":"CISCO","url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2125"},{"name":"http://tools.cisco.com/security/center/viewAlert.x?alertId=33603","refsource":"CONFIRM","url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=33603"}]}}}},"cveMetadata":{"assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","assignerShortName":"cisco","cveId":"CVE-2014-2125","datePublished":"2014-04-02T01:00:00.000Z","dateReserved":"2014-02-25T00:00:00.000Z","dateUpdated":"2024-08-06T10:05:59.885Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-04-02 03:58:17","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:unity_connection:*:\\(2a\\)su3:*:*:*:*:*:*","versionEndIncluding":"8.6","matchCriteriaId":"52D449F3-D3EF-4711-B5B1-0E6DC17ED20C"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:unity_connection:8.6:*:*:*:*:*:*:*","matchCriteriaId":"62C504A3-5B4C-4230-97A9-B3CCDA0CBD31"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:unity_connection:8.6:\\(1\\):*:*:*:*:*:*","matchCriteriaId":"3285A9DA-81A3-4E57-93E6-BCC54FFE3661"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:unity_connection:8.6:\\(2\\):*:*:*:*:*:*","matchCriteriaId":"D3E5E101-6E83-492D-8034-FF435BB92B5E"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:unity_connection:8.6:\\(2a\\)su1:*:*:*:*:*:*","matchCriteriaId":"53861756-06E5-42EF-8E6F-06C21AB92313"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:unity_connection:8.6:\\(2a\\)su2:*:*:*:*:*:*","matchCriteriaId":"AB4C6D85-B322-4C4B-8B4D-6BB2A433A09A"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:unity_connection:8.6\\(1a\\):*:*:*:*:*:*:*","matchCriteriaId":"C40F61A6-A992-4DA4-9730-D145055596C2"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:unity_connection:8.6\\(2a\\):*:*:*:*:*:*:*","matchCriteriaId":"632B8CDD-5ACC-4FFB-950B-480CC43D192D"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"2125","Ordinal":"1","Title":"CVE-2014-2125","CVE":"CVE-2014-2125","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"2125","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in the Web Inbox in Cisco Unity Connection 8.6(2a)SU3 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui33028.","Type":"Description","Title":"CVE-2014-2125"},{"CveYear":"2014","CveId":"2125","Ordinal":"2","NoteData":"2014-04-01","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"2125","Ordinal":"3","NoteData":"2015-05-04","Type":"Other","Title":"Modified"}]}}}