CVE-2014-2347 - Vulnerability Details - OpenCVE

Amtelco miSecureMessages (aka MSM) 6.2 does not properly manage sessions, which allows remote authenticated users to obtain sensitive information via a modified message request.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Complete

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.04584.

Key SSVC decision points have not yet been added.

Vendors	Products
Amtelco	Misecuremessages

Configuration 1 [-]

cpe:2.3:a:amtelco:misecuremessages:6.2:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

AMTELCO has developed an update, Version 6.3, that resolves these vulnerabilities. Schedule an upgrade by emailing or calling AMTELCO’s Field Engineering Department at: email: https://service.amtelco.com/INFINITY/MSM/MSM6.2SecurityBriefing.pdf

Workaround

No workaround given by the vendor.

References

Link	Providers
http://ics-cert.us-cert.gov/advisories/ICSA-14-121-01
https://service.amtelco.com/INFINITY/MSM/MSM6.2SecurityBriefing.pdf
https://www.cisa.gov/news-events/ics-advisories/icsa-14-121-01

History

Thu, 02 Oct 2025 22:45:00 +0000

Type	Values Removed	Values Added
Title		AMTELCO miSecure Information Exposure
Weaknesses		CWE-200
References		https://www.cisa.gov/news-events/ics-advisories/icsa-14-121-01
Metrics	cvssV2_0 `{'score': 3.5, 'vector': 'AV:N/AC:M/Au:S/C:P/I:N/A:N'}`	cvssV2_0 `{'score': 7, 'vector': 'AV:N/AC:M/Au:S/C:C/I:P/A:N'}`

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2014-05-06T10:00:00

Updated: 2025-10-02T22:36:07.818Z

Reserved: 2014-03-13T00:00:00

Link: CVE-2014-2347

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2014-05-06T10:44:06.050

Modified: 2025-10-02T23:15:30.657

Link: CVE-2014-2347

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Android", "iOS", "Blackberry"], "product": "miSecureMessages", "vendor": "AMTELCO", "versions": [{"status": "affected", "version": "6.2"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jared Bird of Allina Health"}], "datePublic": "2014-05-01T06:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Amtelco miSecureMessages (aka MSM) 6.2 does not properly manage sessions, which allows remote authenticated users to obtain sensitive information via a modified message request.</p>"}], "value": "Amtelco miSecureMessages (aka MSM) 6.2 does not properly manage sessions, which allows remote authenticated users to obtain sensitive information via a modified message request."}], "metrics": [{"cvssV2_0": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 7, "confidentialityImpact": "COMPLETE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:C/I:P/A:N", "version": "2.0"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-10-02T22:36:07.818Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-121-01"}, {"tags": ["x_refsource_MISC"], "url": "https://service.amtelco.com/INFINITY/MSM/MSM6.2SecurityBriefing.pdf"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>AMTELCO has developed an update, Version 6.3, that resolves these vulnerabilities.</p><p>Schedule an upgrade by emailing or calling AMTELCO\u2019s Field Engineering Department at:<br><strong>email:</strong> <a target=\"_blank\" rel=\"nofollow\">service@amtelco.com</a><br><strong>phone:</strong> 1-800-553-7679</p><p>Link to the Security Advisory (registration required): <a target=\"_blank\" rel=\"nofollow\" href=\"https://service.amtelco.com/INFINITY/MSM/MSM6.2SecurityBriefing.pdf\">https://service.amtelco.com/INFINITY/MSM/MSM6.2SecurityBriefing.pdf</a></p>\n\n<br>"}], "value": "AMTELCO has developed an update, Version 6.3, that resolves these vulnerabilities.\n\nSchedule an upgrade by emailing or calling AMTELCO\u2019s Field Engineering Department at:\nemail:\u00a0 https://service.amtelco.com/INFINITY/MSM/MSM6.2SecurityBriefing.pdf"}], "source": {"advisory": "ICSA-14-121-01", "discovery": "EXTERNAL"}, "title": "AMTELCO miSecure Information Exposure", "x_generator": {"engine": "Vulnogram 0.2.0"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2014-2347", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Amtelco miSecureMessages (aka MSM) 6.2 does not properly manage sessions, which allows remote authenticated users to obtain sensitive information via a modified message request."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-121-01", "refsource": "MISC", "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-121-01"}, {"name": "https://service.amtelco.com/INFINITY/MSM/MSM6.2SecurityBriefing.pdf", "refsource": "MISC", "url": "https://service.amtelco.com/INFINITY/MSM/MSM6.2SecurityBriefing.pdf"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T10:14:25.250Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-121-01"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://service.amtelco.com/INFINITY/MSM/MSM6.2SecurityBriefing.pdf"}]}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2014-2347", "datePublished": "2014-05-06T10:00:00", "dateReserved": "2014-03-13T00:00:00", "dateUpdated": "2025-10-02T22:36:07.818Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:amtelco:misecuremessages:6.2:*:*:*:*:*:*:*", "matchCriteriaId": "62201826-E5E0-4A0A-A540-1DE3C7F3C291", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Amtelco miSecureMessages (aka MSM) 6.2 does not properly manage sessions, which allows remote authenticated users to obtain sensitive information via a modified message request."}, {"lang": "es", "value": "Amtelco miSecureMessages (tambi\u00e9n conocido como MSM) 6.2 no gestiona debidamente sesiones, lo que permite a usuarios remotos autenticados obtener informaci\u00f3n sensible a trav\u00e9s de una solicitud de mensaje modificada."}], "id": "CVE-2014-2347", "lastModified": "2025-10-02T23:15:30.657", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 7.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:C/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 7.8, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "ics-cert@hq.dhs.gov", "type": "Secondary", "userInteractionRequired": false}, {"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-05-06T10:44:06.050", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://service.amtelco.com/INFINITY/MSM/MSM6.2SecurityBriefing.pdf"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-121-01"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["US Government Resource"], "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-121-01"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://service.amtelco.com/INFINITY/MSM/MSM6.2SecurityBriefing.pdf"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "ics-cert@hq.dhs.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Secondary"}]}