Cisco Adaptive Security Appliance Information Disclosure Vulnerability

A vulnerability in the authorization code of Cisco ASA Software could allow an authenticated, remote attacker to access information stored on the file system of an affected system.

The vulnerability is due to improper implementation of authorization controls when an unprivileged user tries to access files stored on the file system. This vulnerability can be exploited after authentication and only if HTTP server is enabled. An attacker could exploit this vulnerability by sending a crafted URL to the affected system. If the Cisco ASA is configured in multiple context mode, only the user of the admin context will be able to exploit this vulnerability. An exploit could allow the attacker to access files stored on the device file system, which may include the running configuration.

Cisco has confirmed the vulnerability in a security notice and released software updates.

To exploit this vulnerability, an attacker must authenticate to a targeted device. This access requirement reduces the possibility of a successful exploit.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.