4.3

CVE-2014-2138

CRLF injection vulnerability in the web framework in Cisco Security Manager 4.2 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCun82349.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Security Manager Update - Version <= 4.2
Cisco ≫ Security Manager Version 3.0.2
Cisco ≫ Security Manager Version 3.1
Cisco ≫ Security Manager Version 3.1.1
Cisco ≫ Security Manager Version 3.1.1 Update sp3
Cisco ≫ Security Manager Version 3.2
Cisco ≫ Security Manager Version 3.2 Update sp1
Cisco ≫ Security Manager Version 3.2 Update sp2
Cisco ≫ Security Manager Version 3.2.1
Cisco ≫ Security Manager Version 3.2.1 Update sp1
Cisco ≫ Security Manager Version 3.2.2 Update -
Cisco ≫ Security Manager Version 3.2.2 Update sp1
Cisco ≫ Security Manager Version 3.2.2 Update sp2
Cisco ≫ Security Manager Version 3.2.2 Update sp3
Cisco ≫ Security Manager Version 3.2.2 Update sp4
Cisco ≫ Security Manager Version 3.3 Update -
Cisco ≫ Security Manager Version 3.3 Update sp1
Cisco ≫ Security Manager Version 3.3 Update sp2
Cisco ≫ Security Manager Version 3.3.1 Update -
Cisco ≫ Security Manager Version 3.3.1 Update sp1
Cisco ≫ Security Manager Version 3.3.1 Update sp2
Cisco ≫ Security Manager Version 3.3.1 Update sp3
Cisco ≫ Security Manager Version 3.3.1 Update sp4
Cisco ≫ Security Manager Version 4.0 Update -
Cisco ≫ Security Manager Version 4.0 Update sp1
Cisco ≫ Security Manager Version 4.0.1 Update -
Cisco ≫ Security Manager Version 4.0.1 Update sp1
Cisco ≫ Security Manager Version 4.0.1 Update sp2
Cisco ≫ Security Manager Version 4.1
Cisco ≫ Security Manager Version 4.1 Update sp1
Cisco ≫ Security Manager Version 4.1 Update sp2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.95% 0.565
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2138
Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=33607
Vendor Advisory