CVE-2014-3338

Severity: high (CVSS 8.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-08-12 · updated 2026-06-17
Weakness: CWE-20

Description

The CTIManager module in Cisco Unified Communications Manager (CM) 10.0(1), when single sign-on is enabled, does not properly validate Kerberos SSO tokens, which allows remote authenticated users to gain privileges and execute arbitrary commands via crafted token data, aka Bug ID CSCum95491.

Affected products

Cisco Unified Communications Manager: 10.0(1)

References

http://secunia.com/advisories/60054
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3338
http://tools.cisco.com/security/center/viewAlert.x?alertId=35258
http://www.securityfocus.com/bid/69176
http://www.securitytracker.com/id/1030710
https://exchange.xforce.ibmcloud.com/vulnerabilities/95246
http://secunia.com/advisories/60054
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3338
http://tools.cisco.com/security/center/viewAlert.x?alertId=35258
http://www.securityfocus.com/bid/69176
http://www.securitytracker.com/id/1030710
https://exchange.xforce.ibmcloud.com/vulnerabilities/95246

Get alerted when CVE-2014-3338 or the next vulnerability affects your stack