CVE-2014-3333
HighSummary
The server in Cisco Unity Connection versions 9.1(1) and 9.1(2) allows remote authenticated users to obtain privileged access by conducting an 'HTTP Intercept' attack and leveraging the ability to read files within the context of the web-server user account.
Risk Assessment
An attacker could gain access to sensitive data and system functions, potentially leading to serious security breaches within the organization.
Recommendation
It is recommended to upgrade to the latest version of Cisco Unity Connection and implement additional security measures to mitigate the risk of 'HTTP Intercept' attacks.
Other vulnerabilities in Cisco Unity Connection
See all- CVE-2015-0616High
The Connection Conversation Manager (CuCsMgr) process in Cisco Unity Connection in versions 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, and 9.x before 9.1(2)SU2, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (core dump and restart) by improperly terminating SIP TCP connections.
- CVE-2015-0615High
The call-handling implementation in Cisco Unity Connection in versions before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (port consumption) by improperly terminating SIP sessions.
- CVE-2015-0614High
The Connection Conversation Manager (CuCsMgr) process in Cisco Unity Connection before versions 8.5(1)SU7, 8.6(2a)SU4, 9.1(2)SU2, and 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service via crafted SIP INVITE messages.
- CVE-2015-0613High
The Connection Conversation Manager (CuCsMgr) process in Cisco Unity Connection before version 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service via crafted SIP INVITE messages.
- CVE-2015-0612High
The Connection Conversation Manager (CuCsMgr) process in Cisco Unity Connection versions 8.5 before 8.5(1)SU6, 8.6 before 8.6(2a)SU4, and 9.x before 9.1(2)SU2, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (SIP outage) via a crafted UDP packet.
- CVE-2026-20035High
A vulnerability in the web UI of Cisco Unity Connection Web Inbox allows an unauthenticated, remote attacker to conduct SSRF attacks. It is due to improper input validation for specific HTTP requests.
- CVE-2026-20034High
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device. The issue is due to insufficient validation of user-supplied input.
Original NVD description (English source)
The server in Cisco Unity Connection 9.1(1) and 9.1(2) allows remote authenticated users to obtain privileged access by conducting an "HTTP Intercept" attack and leveraging the ability to read files within the context of the web-server user account, aka Bug ID CSCup41014.