Cisco Unified Communications Manager IM and Presence Service Information Disclosure Vulnerability

Bugtraq ID:	71173
Class:	Design Error
CVE:	CVE-2014-8000
Remote:	Yes
Local:	No
Published:	Nov 19 2014 12:00AM
Updated:	Nov 19 2014 12:00AM
Credit:	Cisco
Vulnerable:
Not Vulnerable:

Cisco Unified Communications Manager IM and Presence Service Information Disclosure Vulnerability

Cisco Unified Communications Manager IM and Presence Service is prone to an information-disclosure vulnerability.

An attacker may leverage this issue to harvest valid user accounts, which may aid in brute-force attacks.

This issue being tracked by Cisco Bug ID CSCur63497.

Cisco Unified Communications Manager IM and Presence Service Information Disclosure Vulnerability

An attacker can exploit this issue by supplying the device with specially crafted URL requests.

Cisco Unified Communications Manager IM and Presence Service Information Disclosure Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Cisco Unified Communications Manager IM and Presence Service Information Disclosure Vulnerability

References:

• Cisco Homepage (Cisco )