CVE-2009-3457

published 2009-09-29

CVE-2009-3457: Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that…

Priority P4 27 medium 5 CVSS 2.0

AV N AC L Au N C P I N A N

EXPLOIT

Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
cisco	ace_web_application_firewall	<= 6.0\(3\)	—
cisco	ace_web_application_firewall	—	—
cisco	ace_web_application_firewall	—	—
cisco	ace_web_application_firewall	—	—
cisco	ace_xml_gateway	<= 6.0\(3\)	—
cisco	ace_xml_gateway	—	—
cisco	ace_xml_gateway	—	—
cisco	ace_xml_gateway	—	—

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200