Directory Information Disclosure in Cisco TelePresence System by Cisco

CVE-2014-3274

Summary

The Cisco TelePresence System is susceptible to a directory information disclosure vulnerability that occurs when the system reverts to unencrypted HTTP during certain HTTPS session failures. This fallback allows man-in-the-middle attackers to intercept and collect sensitive directory information. By positioning themselves within the network traffic between the Cisco TelePresence System and the Cisco Unified Communications Manager, attackers can block HTTPS traffic, enabling unauthorized access to confidential data.

References