CVE-2014-2138

CWE-20 — Improper Input Validation4 documents4 sources
Severity
4.3MEDIUM
EPSS
0.2%
top 56.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Security Manager
Timeline
PublishedApr 2
Latest updateMay 17

Description

CRLF injection vulnerability in the web framework in Cisco Security Manager 4.2 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCun82349.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-xv6g-jhvf-9jh9: CRLF injection vulnerability in the web framework in Cisco Security Manager 4↗2022-05-17
▶
CVEList
CVE-2014-2138: CRLF injection vulnerability in the web framework in Cisco Security Manager 4↗2014-04-02
▶

📋Vendor Advisories

1
Cisco
Cisco Security Manager HTTP Header Redirection Vulnerability↗2014-04-01
▶