Published: 29/06/2010 Updated: 11/10/2018

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 435

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

CRLF injection vulnerability in +webvpn+/index.html in WebVPN on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software prior to 8.1(2) allows remote malicious users to inject arbitrary HTTP headers as demonstrated by a redirect attack involving a %0d%0aLocation%3a sequence in a URI, or conduct HTTP response splitting attacks via unspecified vectors, aka Bug ID CSCsr09163.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cisco asa 5580 8.1\\(1\\)

Cisco ASA Software versions prior to 81(2) contain a vulnerability that could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks The vulnerability exists due to improper handling of characters within URLs An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to view a malicious ...

source: wwwsecurityfocuscom/bid/41159/info Cisco Adaptive Security Response (ASA) is prone to an HTTP response-splitting vulnerability Attackers can leverage this issue to influence or misrepresent how web content is served, cached, or interpreted This could aid in various attacks that try to entice client users into having a false sen ...

Cisco Adaptive Security Appliance (ASA) is vulnerable to HTTP response splitting caused by improper validation of user-supplied input A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim?s web browser within the security context of the Adaptive Security Appliance site Versions 81(1) and e ...

CWE-20 http://www.cisco.com/en/US/docs/security/asa/asa81/release/notes/asarn812.html http://www.securityfocus.com/bid/41159 http://securitytracker.com/id?1024155 http://www.secureworks.com/ctu/advisories/SWRX-2010-001 https://exchange.xforce.ibmcloud.com/vulnerabilities/59850 http://www.securityfocus.com/archive/1/512023/100/0/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/34200/http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20100625-CVE-2008-7257

CVE-2008-7257

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect