Cisco Unified Communications Domain Manager BVSMWeb User Enumeration Vulnerability

Bugtraq ID:	67924
Class:	Access Validation Error
CVE:	CVE-2014-3278
Remote:	Yes
Local:	No
Published:	Jun 06 2014 12:00AM
Updated:	Jun 06 2014 12:00AM
Credit:	Cisco
Vulnerable:
Not Vulnerable:

Cisco Unified Communications Domain Manager BVSMWeb User Enumeration Vulnerability

Cisco Unified Communications Domain Manager is prone to a user-enumeration vulnerability.

An attacker may leverage this issue to harvest valid user accounts, which may aid in brute-force attacks.

This issue being tracked by Cisco Bug IDs CSCun39619, CSCun45572.

Cisco Unified Communications Domain Manager BVSMWeb User Enumeration Vulnerability

An attacker can exploit this issue by supplying the application with specially crafted URL requests.

Attackers can exploit this issue using browser or readily available tools.

Cisco Unified Communications Domain Manager BVSMWeb User Enumeration Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Cisco Unified Communications Domain Manager BVSMWeb User Enumeration Vulnerability

References:

• Cisco Homepage (Cisco )