Details of VAR-201405-0471

ID

VAR-201405-0471

CVE

CVE-2014-2194

TITLE

Cisco Unified Web and E-mail Interaction Manager Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2014-002547

DESCRIPTION

system/egain/chat/entrypoint in Cisco Unified Web and E-mail Interaction Manager 9.0(2) allows remote attackers to have an unspecified impact by injecting a spoofed XML external entity. Exploiting this issue may allow a remote attacker to perform unauthorized actions. This may lead to further attacks. This issue is being tracked by Cisco Bug ID CSCuj43080. Web Interaction Manager is a product that can help call center business representatives use websites and text chats or real-time Web collaboration to answer customer questions; E-mail Interaction Manager is a product used to manage a large number of customer emails submitted to corporate mailboxes or websites

Trust: 1.98

sources: NVD: CVE-2014-2194 // JVNDB: JVNDB-2014-002547 // BID: 67458 // VULHUB: VHN-70133

AFFECTED PRODUCTS

vendor:	cisco	model:	unified web and e-mail interaction manager	scope:	eq	version:	9.0\(2\)	Trust: 1.6
vendor:	cisco	model:	unified web and e-mail interaction manager	scope:	eq	version:	9.0(2)	Trust: 0.8

sources: JVNDB: JVNDB-2014-002547 // CNNVD: CNNVD-201405-380 // NVD: CVE-2014-2194

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2014-2194
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2014-2194
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201405-380
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-70133
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2014-2194
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-70133
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-70133 // JVNDB: JVNDB-2014-002547 // CNNVD: CNNVD-201405-380 // NVD: CVE-2014-2194

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-70133 // JVNDB: JVNDB-2014-002547 // NVD: CVE-2014-2194

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201405-380

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201405-380

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-002547

PATCH

title:	Cisco Unified Web and E-mail Interaction Manager XML External Entities Vulnerability	url:	http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2194	Trust: 0.8
title:	34270	url:	http://tools.cisco.com/security/center/viewAlert.x?alertId=34270	Trust: 0.8

sources: JVNDB: JVNDB-2014-002547

EXTERNAL IDS

db:	NVD	id:	CVE-2014-2194	Trust: 2.8
db:	JVNDB	id:	JVNDB-2014-002547	Trust: 0.8
db:	CNNVD	id:	CNNVD-201405-380	Trust: 0.7
db:	CISCO	id:	20140516 CISCO UNIFIED WEB AND E-MAIL INTERACTION MANAGER XML EXTERNAL ENTITIES VULNERABILITY	Trust: 0.6
db:	BID	id:	67458	Trust: 0.4
db:	VULHUB	id:	VHN-70133	Trust: 0.1

sources: VULHUB: VHN-70133 // BID: 67458 // JVNDB: JVNDB-2014-002547 // CNNVD: CNNVD-201405-380 // NVD: CVE-2014-2194

REFERENCES

url:	http://tools.cisco.com/security/center/content/ciscosecuritynotice/cve-2014-2194	Trust: 1.7
url:	http://tools.cisco.com/security/center/viewalert.x?alertid=34270	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2194	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2194	Trust: 0.8
url:	www.cisco.com	Trust: 0.3

sources: VULHUB: VHN-70133 // BID: 67458 // JVNDB: JVNDB-2014-002547 // CNNVD: CNNVD-201405-380 // NVD: CVE-2014-2194

CREDITS

Cisco

Trust: 0.3

sources: BID: 67458

SOURCES

db:	VULHUB	id:	VHN-70133
db:	BID	id:	67458
db:	JVNDB	id:	JVNDB-2014-002547
db:	CNNVD	id:	CNNVD-201405-380
db:	NVD	id:	CVE-2014-2194

LAST UPDATE DATE

2025-04-13T23:10:15.465000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-70133	date:	2014-05-20T00:00:00
db:	BID	id:	67458	date:	2014-05-16T00:00:00
db:	JVNDB	id:	JVNDB-2014-002547	date:	2014-05-21T00:00:00
db:	CNNVD	id:	CNNVD-201405-380	date:	2014-05-23T00:00:00
db:	NVD	id:	CVE-2014-2194	date:	2025-04-12T10:46:40.837

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-70133	date:	2014-05-20T00:00:00
db:	BID	id:	67458	date:	2014-05-16T00:00:00
db:	JVNDB	id:	JVNDB-2014-002547	date:	2014-05-21T00:00:00
db:	CNNVD	id:	CNNVD-201405-380	date:	2014-05-23T00:00:00
db:	NVD	id:	CVE-2014-2194	date:	2014-05-20T11:13:37.530