CVE-2016-6461 — Improper Input Validation in Cisco Adaptive Security Appliance Software

CWE-20 — Improper Input Validation4 documents4 sources
Severity
5.9MEDIUMNVD
EPSS
0.6%
top 29.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Adaptive Security Appliance Software
Timeline
PublishedNov 19
Latest updateMay 14

Description

A vulnerability in the HTTP web-based management interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to inject arbitrary XML commands on the affected system. More Information: CSCva38556. Known Affected Releases: 9.1(6.10). Known Fixed Releases: 100.11(0.75) 100.15(0.137) 100.8(40.129) 96.2(0.95) 97.1(0.55) 97.1(12.7) 97.1(6.30).

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-mr8c-v6w9-mj48: A vulnerability in the HTTP web-based management interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attac↗2022-05-14
▶
CVEList
CVE-2016-6461: A vulnerability in the HTTP web-based management interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attac↗2016-11-19
▶

📋Vendor Advisories

1
Cisco
Cisco ASA Input Validation File Injection Vulnerability↗2016-11-16
▶
CVE-2016-6461 — Improper Input Validation in Cisco | cvebase