CVE-2009-4455

CWE-2643 documents3 sources
Severity
6.5MEDIUM
EPSS
0.4%
top 38.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Adaptive Security Appliance 5500
Timeline
PublishedDec 29
Latest updateMay 2

Description

The default configuration of Cisco ASA 5500 Series Adaptive Security Appliance (Cisco ASA) 7.0, 7.1, 7.2, 8.0, 8.1, and 8.2 allows portal traffic to access arbitrary backend servers, which might allow remote authenticated users to bypass intended access restrictions and access unauthorized web sites via a crafted URL obfuscated with ROT13 and a certain encoding. NOTE: this issue was originally reported as a vulnerability related to lack of restrictions to URLs listed in the Cisco WebVPN bookmark…

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 8.0 | Impact: 6.4

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-gmxh-fcvg-35xj: The default configuration of Cisco ASA 5500 Series Adaptive Security Appliance (Cisco ASA) 7↗2022-05-02
▶
CVEList
CVE-2009-4455: The default configuration of Cisco ASA 5500 Series Adaptive Security Appliance (Cisco ASA) 7↗2009-12-29
▶