4.3
CVE-2012-2494
- EPSS 0.2%
- Veröffentlicht 20.06.2012 20:55:02
- Zuletzt bearbeitet 11.04.2025 00:51:21
- Quelle psirt@cisco.com
- Teams Watchlist Login
- Unerledigt Login
The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 and 3.x before 3.0 MR8 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a version downgrade by using (1) ActiveX or (2) Java components to offer signed code that corresponds to an older software release, aka Bug ID CSCtw48681.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Anyconnect Secure Mobility Client Version2.0
Cisco ≫ Anyconnect Secure Mobility Client Version2.1
Cisco ≫ Anyconnect Secure Mobility Client Version2.2
Cisco ≫ Anyconnect Secure Mobility Client Version2.2.128
Cisco ≫ Anyconnect Secure Mobility Client Version2.2.133
Cisco ≫ Anyconnect Secure Mobility Client Version2.2.136
Cisco ≫ Anyconnect Secure Mobility Client Version2.2.140
Cisco ≫ Anyconnect Secure Mobility Client Version2.3
Cisco ≫ Anyconnect Secure Mobility Client Version2.3.185
Cisco ≫ Anyconnect Secure Mobility Client Version2.3.254
Cisco ≫ Anyconnect Secure Mobility Client Version2.3.2016
Cisco ≫ Anyconnect Secure Mobility Client Version2.4
Cisco ≫ Anyconnect Secure Mobility Client Version2.4.0202
Cisco ≫ Anyconnect Secure Mobility Client Version2.4.1012
Cisco ≫ Anyconnect Secure Mobility Client Version2.5
Cisco ≫ Anyconnect Secure Mobility Client Version3.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.2% | 0.388 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.