7.5
CVE-2011-2054
- EPSS 0.86%
- Veröffentlicht 19.02.2020 03:15:10
- Zuletzt bearbeitet 21.11.2024 01:27:30
- Erkennungen
LoginCisco ASA Secondary Authentication Bypass Vulnerability
A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password is left blank, providing the primary credentials are correct. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker must have the correct primary credentials in order to successfully exploit this vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Asa 5500 Firmware Version 8.4(1)
Cisco ≫ Asa 5510 Firmware Version 8.4(1)
Cisco ≫ Asa 5512-x Firmware Version 8.4(1)
Cisco ≫ Asa 5515-x Firmware Version 8.4(1)
Cisco ≫ Asa 5520 Firmware Version 8.4(1)
Cisco ≫ Asa 5525-x Firmware Version 8.4(1)
Cisco ≫ Asa 5540 Firmware Version 8.4(1)
Cisco ≫ Asa 5545-x Firmware Version 8.4(1)
Cisco ≫ Asa 5550 Firmware Version 8.4(1)
Cisco ≫ Asa 5555-x Firmware Version 8.4(1)
Cisco ≫ Asa 5580 Firmware Version 8.4(1)
Cisco ≫ Asa 5585-x Firmware Version 8.4(1)
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.86% | 0.537 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.5 | 1.6 | 5.9 |
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| NIST | 6 | 6.8 | 6.4 |
AV:N/AC:M/Au:S/C:P/I:P/A:P
|
| Cisco PSIRT | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
|
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
https://quickview.cloudapps.cisco.com/quickview/bug/CSCtq58884