CVE-2014-3274

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Cisco TelePresence System (CTS) 6.0(.5)(5) and earlier falls back to HTTP when certain HTTPS sessions cannot be established, which allows man-in-the-middle attackers to obtain sensitive directory information by leveraging a network position between CTS and Cisco Unified Communications Manager (UCM) to block HTTPS traffic, aka Bug ID CSCuj26326.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-310

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3274Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=34327Vendor Advisory
http://www.securitytracker.com/id/1030272Third Party Advisory, VDB Entry
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3274Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=34327Vendor Advisory
http://www.securitytracker.com/id/1030272Third Party Advisory, VDB Entry

Timeline

Published: May 26, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-32756.5SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier allows remote authentic CVE-2014-32764.0Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier does not properly handle deadlock conditions during reception of crafted RA CVE-2014-32774.0The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not proper CVE-2014-32785.0The web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) does not properly implement access control, which allows remo CVE-2014-32795.0The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not proper CVE-2014-32804.0The web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access contro CVE-2014-32815.0The web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) does not properly implement access control, which allows remo CVE-2014-32824.0The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not proper CVE-2014-32835.8Open redirect vulnerability in Self-Care Client Portal applications in the web framework in VOSS in Cisco Unified Communications Domain Mana CVE-2014-32846.1Cisco IOS XE on ASR1000 devices, when PPPoE termination is enabled, allows remote attackers to cause a denial of service (device reload) via CVE-2014-32855.0Cisco Wide Area Application Services (WAAS) 5.3(.5a) and earlier, when SharePoint acceleration is enabled, does not properly parse SharePoin CVE-2014-32865.0The web framework in Cisco WebEx Meeting Server does not properly restrict the content of reply messages, which allows remote attackers to o