CVE-2019-1713 — Cross-Site Request Forgery in Cisco Adaptive Security Appliance Software

CWE-352 — Cross-Site Request Forgery4 documents4 sources

Severity

8.8HIGHNVD

CNA8.1

EPSS

0.2%

top 51.85%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Adaptive Security Appliance Software Cisco Adaptive Security Appliance Software

Timeline

PublishedMay 3

Latest updateMay 24

Description

A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the a…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDcisco/adaptive_security_appliance_software9.5 — 9.6.4.25+4

▶CVEListV5cisco/cisco_adaptive_security_appliance_softwareunspecified — 9.4.4.34+4

🔴Vulnerability Details

GHSA

GHSA-c2vh-w5p4-hr7q: A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attac↗2022-05-24

▶

CVEList

Cisco Adaptive Security Appliance Software Cross-Site Request Forgery Vulnerability↗2019-05-03

▶

📋Vendor Advisories

Cisco

Cisco Adaptive Security Appliance Software Cross-Site Request Forgery Vulnerability↗2019-05-01

▶