Description
The CTIManager module in Cisco Unified Communications Manager (CM) 10.0(1), when single sign-on is enabled, does not properly validate Kerberos SSO tokens, which allows remote authenticated users to gain privileges and execute arbitrary commands via crafted token data, aka Bug ID CSCum95491.
References
- 60054 third-party-advisory
- 20140811 Cisco Unified Communications Manager CTIManager Vulnerability vendor-advisory
- cucm-cve20143338-command-exec(95246) vdb-entry
- 1030710 vdb-entry
- http://tools.cisco.com/security/center/viewAlert.x?alertId=35258
- 69176 vdb-entry