Lucene search

[email protected]NVD:CVE-2009-3457

HistorySep 29, 2009 - 6:00 p.m.

CVE-2009-3457

2009-09-2918:00:00

CWE-200

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.3

Confidence

Low

EPSS

0.013

Percentile

86.1%

JSON

Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.

Affected configurations

Nvd

Node

ciscoace_web_application_firewallRange≤6.0\(3\)

ciscoace_web_application_firewallMatch6.0\(0\)

ciscoace_web_application_firewallMatch6.0\(1\)

ciscoace_web_application_firewallMatch6.0\(2\)

ciscoace_xml_gatewayRange≤6.0\(3\)

ciscoace_xml_gatewayMatch6.0\(0\)

ciscoace_xml_gatewayMatch6.0\(1\)

ciscoace_xml_gatewayMatch6.0\(2\)

VendorProductVersionCPE
ciscoace_web_application_firewall*cpe:2.3:h:cisco:ace_web_application_firewall:*:*:*:*:*:*:*:*
ciscoace_web_application_firewall6.0(0)cpe:2.3:h:cisco:ace_web_application_firewall:6.0\(0\):*:*:*:*:*:*:*
ciscoace_web_application_firewall6.0(1)cpe:2.3:h:cisco:ace_web_application_firewall:6.0\(1\):*:*:*:*:*:*:*
ciscoace_web_application_firewall6.0(2)cpe:2.3:h:cisco:ace_web_application_firewall:6.0\(2\):*:*:*:*:*:*:*
ciscoace_xml_gateway*cpe:2.3:h:cisco:ace_xml_gateway:*:*:*:*:*:*:*:*
ciscoace_xml_gateway6.0(0)cpe:2.3:h:cisco:ace_xml_gateway:6.0\(0\):*:*:*:*:*:*:*
ciscoace_xml_gateway6.0(1)cpe:2.3:h:cisco:ace_xml_gateway:6.0\(1\):*:*:*:*:*:*:*
ciscoace_xml_gateway6.0(2)cpe:2.3:h:cisco:ace_xml_gateway:6.0\(2\):*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	ace_web_application_firewall	*	cpe:2.3:h:cisco:ace_web_application_firewall::::::::
cisco	ace_web_application_firewall	6.0(0)	cpe:2.3:h:cisco:ace_web_application_firewall:6.0\(0\):::::::*
cisco	ace_web_application_firewall	6.0(1)	cpe:2.3:h:cisco:ace_web_application_firewall:6.0\(1\):::::::*
cisco	ace_web_application_firewall	6.0(2)	cpe:2.3:h:cisco:ace_web_application_firewall:6.0\(2\):::::::*
cisco	ace_xml_gateway	*	cpe:2.3:h:cisco:ace_xml_gateway::::::::
cisco	ace_xml_gateway	6.0(0)	cpe:2.3:h:cisco:ace_xml_gateway:6.0\(0\):::::::*
cisco	ace_xml_gateway	6.0(1)	cpe:2.3:h:cisco:ace_xml_gateway:6.0\(1\):::::::*
cisco	ace_xml_gateway	6.0(2)	cpe:2.3:h:cisco:ace_xml_gateway:6.0\(2\):::::::*

References

seclists.org/fulldisclosure/2009/Sep/0369.html

secunia.com/advisories/36879

www.brainoverflow.org/advisories/cisco_ace_xml_gw_ip_disclosure.txt

www.cisco.com/en/US/products/products_security_response09186a0080af8965.html

www.securityfocus.com/archive/1/506716/100/0/threaded

www.securityfocus.com/bid/36522

www.securitytracker.com/id?1022949

www.vupen.com/english/advisories/2009/2778

exchange.xforce.ibmcloud.com/vulnerabilities/53482

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.3

Confidence

Low

EPSS

0.013

Percentile

86.1%

JSON

Related for NVD:CVE-2009-3457

cve1 prion1 exploitdb1 cvelist1