CVE-2014-2138
published 2014-04-02CVE-2014-2138: CRLF injection vulnerability in the web framework in Cisco Security Manager 4.2 and earlier allows remote attackers to inject arbitrary HTTP headers and…
PriorityP421medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
0.95%
57.3th percentile
CRLF injection vulnerability in the web framework in Cisco Security Manager 4.2 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCun82349.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | security_manager | <= 4.2 | — |
| cisco | security_manager | — | — |
| cisco | security_manager | — | — |
| cisco | security_manager | — | — |
| cisco | security_manager | — | — |
| cisco | security_manager | — | — |
| cisco | security_manager | — | — |
| cisco | security_manager | — | — |
| cisco | security_manager | — | — |
| cisco | security_manager | — | — |
| cisco | security_manager | — | — |
| cisco | security_manager | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_cisco4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Security Manager HTTP Header Redirection Vulnerability
vendor_cisco·2014-04-01·CVSS 4.3
CVE-2014-2138 [MEDIUM] CWE-20 Cisco Security Manager HTTP Header Redirection Vulnerability
Cisco Security Manager HTTP Header Redirection Vulnerability
A vulnerability in the web framework of Cisco Security Manager could allow an unauthenticated, remote attacker to inject a crafted HTTP header, which will cause a web page redirection to a possible malicious website.
The vulnerability is due to insufficient validation of user input before using it as an HTTP header value. An attacker could exploit this vulnerability by convincing a user to access a crafted URL.
Cisco has confirmed the vulnerability in a security notice; however, software updates are not available.
To exploit the vulnerability, the attacker may provide a link that directs a user to a malicious site and use misleading language or instructions to persuade the user to follow the provided link.
Cisco indicates t
GHSA
GHSA-xv6g-jhvf-9jh9: CRLF injection vulnerability in the web framework in Cisco Security Manager 4
ghsa_unreviewed·2022-05-17
CVE-2014-2138 [MEDIUM] CWE-20 GHSA-xv6g-jhvf-9jh9: CRLF injection vulnerability in the web framework in Cisco Security Manager 4
CRLF injection vulnerability in the web framework in Cisco Security Manager 4.2 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCun82349.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2014-04-02
Published