{"api_version":"1","generated_at":"2026-07-23T11:21:00+00:00","cve":"CVE-2014-3373","urls":{"html":"https://cve.report/CVE-2014-3373","api":"https://cve.report/api/cve/CVE-2014-3373.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-3373","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-3373"},"summary":{"title":"CVE-2014-3373","description":"Multiple cross-site scripting (XSS) vulnerabilities in the CCM Dialed Number Analyzer interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCup92550.","state":"PUBLISHED","assigner":"cisco","published_at":"2014-10-31 10:55:02","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securitytracker.com/id/1031161","name":"http://www.securitytracker.com/id/1031161","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Cisco Unified Communications Manager Input Validation Flaw in CCM Dialed Number Analyzer Interface Permits Cross-Site Scripting Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3373","name":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3373","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/98406","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/98406","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=36294","name":"http://tools.cisco.com/security/center/viewAlert.x?alertId=36294","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/59692","name":"http://secunia.com/advisories/59692","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA59692 - Cisco Unified Communications Manager CCM Dialed Number Analyzer Interface Cross-Site Scripting Vulnerability - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/70848","name":"http://www.securityfocus.com/bid/70848","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Cisco Unified Communications Manager CVE-2014-3373 Multiple Cross Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3373","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3373","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"3373","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"unified_communications_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T10:43:05.171Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20141030 Cisco Unified Communications Manager DNA Interface Reflected Cross-Site Scripting Vulnerability","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"],"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3373"},{"name":"59692","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/59692"},{"name":"70848","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/70848"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=36294"},{"name":"1031161","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1031161"},{"name":"cisco-ucm-cve20143373-xss(98406)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/98406"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-10-30T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in the CCM Dialed Number Analyzer interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCup92550."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco"},"references":[{"name":"20141030 Cisco Unified Communications Manager DNA Interface Reflected Cross-Site Scripting Vulnerability","tags":["vendor-advisory","x_refsource_CISCO"],"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3373"},{"name":"59692","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/59692"},{"name":"70848","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/70848"},{"tags":["x_refsource_CONFIRM"],"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=36294"},{"name":"1031161","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1031161"},{"name":"cisco-ucm-cve20143373-xss(98406)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/98406"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@cisco.com","ID":"CVE-2014-3373","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in the CCM Dialed Number Analyzer interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCup92550."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20141030 Cisco Unified Communications Manager DNA Interface Reflected Cross-Site Scripting Vulnerability","refsource":"CISCO","url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3373"},{"name":"59692","refsource":"SECUNIA","url":"http://secunia.com/advisories/59692"},{"name":"70848","refsource":"BID","url":"http://www.securityfocus.com/bid/70848"},{"name":"http://tools.cisco.com/security/center/viewAlert.x?alertId=36294","refsource":"CONFIRM","url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=36294"},{"name":"1031161","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1031161"},{"name":"cisco-ucm-cve20143373-xss(98406)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/98406"}]}}}},"cveMetadata":{"assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","assignerShortName":"cisco","cveId":"CVE-2014-3373","datePublished":"2014-10-31T10:00:00.000Z","dateReserved":"2014-05-07T00:00:00.000Z","dateUpdated":"2024-08-06T10:43:05.171Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-10-31 10:55:02","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"8D51B262-3855-4384-A0EA-FE115D544953"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"3373","Ordinal":"1","Title":"CVE-2014-3373","CVE":"CVE-2014-3373","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"3373","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in the CCM Dialed Number Analyzer interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCup92550.","Type":"Description","Title":"CVE-2014-3373"},{"CveYear":"2014","CveId":"3373","Ordinal":"2","NoteData":"2014-10-31","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"3373","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}