CVE-2015-4289
published 2015-08-01CVE-2015-4289: Directory traversal vulnerability in Cisco AnyConnect Secure Mobility Client 4.0(2049) allows remote head-end systems to write to arbitrary files via a crafted…
PriorityP338medium6.4CVSS 2.0
AVNACLAuNCNIPAP
EPSS
1.93%
77.6th percentile
Directory traversal vulnerability in Cisco AnyConnect Secure Mobility Client 4.0(2049) allows remote head-end systems to write to arbitrary files via a crafted configuration attribute, aka Bug ID CSCut93920.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | anyconnect_secure_mobility_client | — | — |
CVSS provenance
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:P
vendor_cisco6.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco AnyConnect Secure Mobilty Client Directory Traversal Vulnerability
vendor_cisco·2015-07-30·CVSS 6.4
CVE-2015-4289 [MEDIUM] CWE-20 Cisco AnyConnect Secure Mobilty Client Directory Traversal Vulnerability
Cisco AnyConnect Secure Mobilty Client Directory Traversal Vulnerability
A vulnerability in the connection establishment process of Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, remote attacker to write or overwrite files in the active user's context.
The vulnerability is due to insufficient input validation. An unauthenticated, remote attacker could exploit this vulnerability by persuading a user to connect to a malicious head-end system. The malicious head-end system could be used to pass back crafted configuration attributes, which the attacker could leverage to execute a directory traversal attack. A successful exploit could allow the attacker to write or overwrite any file in the active user's context. The location or file must be writable by the user runni
GHSA
GHSA-h83x-38m4-m38j: Directory traversal vulnerability in Cisco AnyConnect Secure Mobility Client 4
ghsa_unreviewed·2022-05-17
CVE-2015-4289 [MEDIUM] CWE-22 GHSA-h83x-38m4-m38j: Directory traversal vulnerability in Cisco AnyConnect Secure Mobility Client 4
Directory traversal vulnerability in Cisco AnyConnect Secure Mobility Client 4.0(2049) allows remote head-end systems to write to arbitrary files via a crafted configuration attribute, aka Bug ID CSCut93920.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2015-08-01
Published