CVE-2014-2137

2014-04-0203:58:17

CWE-20

[email protected]

web.nvd.nist.gov

cisco

web security appliance

wsa

vulnerability

crlf injection

redirection attacks

cve-2014-2137

bug id cscuj61002

7 High

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

50.5%

JSON

CRLF injection vulnerability in the web framework in Cisco Web Security Appliance (WSA) 7.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCuj61002.

Affected configurations

NVD

Node

ciscoweb_security_virtual_applianceRange≤7.7

ciscoweb_security_virtual_applianceMatch7.1.0

ciscoweb_security_virtual_applianceMatch7.1.1

ciscoweb_security_virtual_applianceMatch7.1.2

ciscoweb_security_virtual_applianceMatch7.1.3

ciscoweb_security_virtual_applianceMatch7.1.4

ciscoweb_security_virtual_applianceMatch7.5.0

ciscoweb_security_virtual_applianceMatch7.5.1

ciscoweb_security_applianceMatch-

CPENameOperatorVersion
cisco:web_security_virtual_appliancecisco web security virtual appliancele7.7
cisco:web_security_virtual_appliancecisco web security virtual applianceeq7.1.0
cisco:web_security_virtual_appliancecisco web security virtual applianceeq7.1.1
cisco:web_security_virtual_appliancecisco web security virtual applianceeq7.1.2
cisco:web_security_virtual_appliancecisco web security virtual applianceeq7.1.3
cisco:web_security_virtual_appliancecisco web security virtual applianceeq7.1.4
cisco:web_security_virtual_appliancecisco web security virtual applianceeq7.5.0
cisco:web_security_virtual_appliancecisco web security virtual applianceeq7.5.1
cisco:web_security_appliancecisco web security applianceeq-

CPE	Name	Operator	Version
cisco:web_security_virtual_appliance	cisco web security virtual appliance	le	7.7
cisco:web_security_virtual_appliance	cisco web security virtual appliance	eq	7.1.0
cisco:web_security_virtual_appliance	cisco web security virtual appliance	eq	7.1.1
cisco:web_security_virtual_appliance	cisco web security virtual appliance	eq	7.1.2
cisco:web_security_virtual_appliance	cisco web security virtual appliance	eq	7.1.3
cisco:web_security_virtual_appliance	cisco web security virtual appliance	eq	7.1.4
cisco:web_security_virtual_appliance	cisco web security virtual appliance	eq	7.5.0
cisco:web_security_virtual_appliance	cisco web security virtual appliance	eq	7.5.1
cisco:web_security_appliance	cisco web security appliance	eq	-