Description
The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly handle role restrictions, which allows remote authenticated users to bypass role-based access control via multiple visits to a forbidden portal URL, aka Bug ID CSCuj83540.
References
- 101800 vdb-entry
- cisco-ucm-cve20140657-sec-bypass(90120) vdb-entry
- 56368 third-party-advisory
- 20140107 Cisco Unified Communications Manager Role Bypass Vulnerability vendor-advisory
- http://tools.cisco.com/security/center/viewAlert.x?alertId=32341
- 64690 vdb-entry
- 1029571 vdb-entry