CVE-2014-0657

MediumCVSS 4.0/10Last modified Jun 17, 2026

Description

The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly handle role restrictions, which allows remote authenticated users to bypass role-based access control via multiple visits to a forbidden portal URL, aka Bug ID CSCuj83540.

Metrics

CVSS 2.0 4.0/10AV:N/AC:L/Au:S/C:P/I:N/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/101800
http://secunia.com/advisories/56368
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0657Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=32341Vendor Advisory
http://www.securityfocus.com/bid/64690Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029571Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90120
http://osvdb.org/101800
http://secunia.com/advisories/56368
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0657Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=32341Vendor Advisory
http://www.securityfocus.com/bid/64690Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029571Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90120

Timeline

Published: Jan 8, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-06585.4Cisco 9900 Unified IP phones allow remote attackers to cause a denial of service (unregistration) via a crafted SIP header, aka Bug ID CSCul CVE-2014-065910.0The Cisco WAP4410N access point with firmware through 2.0.6.1, WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1, an CVE-2014-06607.1Cisco TelePresence ISDN Gateway with software before 2.2(1.92) allows remote attackers to cause a denial of service (D-channel call outage) CVE-2014-06618.3The System Status Collection Daemon (SSCD) in Cisco TelePresence System 500-37, 1000, 1300-65, and 3xxx before 1.10.2(42), and 500-32, 1300-CVE-2014-06627.1The SIP module in Cisco TelePresence Video Communication Server (VCS) before 8.1 allows remote attackers to cause a denial of service (proce CVE-2014-06634.3Cross-site scripting (XSS) vulnerability in the web framework in Cisco Secure Access Control System (ACS) allows remote attackers to inject CVE-2014-06646.8The server in Cisco Unity Connection allows remote authenticated users to cause a denial of service (CPU consumption) via unspecified IMAP c CVE-2014-06654.0The RBAC implementation in Cisco Identity Services Engine (ISE) Software does not properly verify privileges for support-bundle downloads, w CVE-2014-06664.3Directory traversal vulnerability in the Send Screen Capture implementation in Cisco Jabber 9.2(.1) and earlier on Windows allows remote att CVE-2014-06676.3The RMI interface in Cisco Secure Access Control System (ACS) does not properly enforce authorization requirements, which allows remote auth CVE-2014-06684.3Cross-site scripting (XSS) vulnerability in the portal in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitra CVE-2014-06695.0The Wireless Session Protocol (WSP) feature in the Gateway GPRS Support Node (GGSN) component on Cisco ASR 5000 series devices allows remote