VAR-201404-0572
Vulnerability from variot - Updated: 2023-12-18 12:21The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.47, 8.3 before 8.3(2.40), 8.4 before 8.4(7.3), 8.6 before 8.6(1.13), 9.0 before 9.0(3.8), and 9.1 before 9.1(3.2) allows remote attackers to bypass authentication via (1) a crafted cookie value within modified HTTP POST data or (2) a crafted URL, aka Bug ID CSCua85555. Exploiting this issue could allow an attacker to bypass certain security restrictions and gain unauthenticated access to the SSL VPN Portal page. This issue is tracked by Cisco Bug ID CSCua85555
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201404-0572",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "adaptive security appliance software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "8.6"
},
{
"model": "adaptive security appliance software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "8.4"
},
{
"model": "adaptive security appliance software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "9.0"
},
{
"model": "adaptive security appliance software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "8.2"
},
{
"model": "adaptive security appliance software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "8.3\\(1\\)"
},
{
"model": "adaptive security appliance software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "9.1"
},
{
"model": "adaptive security appliance software",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco",
"version": "8.3"
},
{
"model": "adaptive security appliance",
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": "adaptive security appliance software",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco",
"version": "8.6(1.13)"
},
{
"model": "adaptive security appliance software",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco",
"version": "8.2"
},
{
"model": "adaptive security appliance software",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco",
"version": "9.1(3.2)"
},
{
"model": "adaptive security appliance software",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco",
"version": "8.2(5.47)"
},
{
"model": "adaptive security appliance software",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco",
"version": "8.3(2.40)"
},
{
"model": "adaptive security appliance software",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco",
"version": "8.4"
},
{
"model": "adaptive security appliance software",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco",
"version": "9.0(3.8)"
},
{
"model": "adaptive security appliance software",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco",
"version": "9.1"
},
{
"model": "adaptive security appliance software",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco",
"version": "9.0"
},
{
"model": "adaptive security appliance software",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco",
"version": "8.4(7.3)"
},
{
"model": "adaptive security appliance software",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco",
"version": "8.6"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-001941"
},
{
"db": "NVD",
"id": "CVE-2014-2128"
},
{
"db": "CNNVD",
"id": "CNNVD-201404-115"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:cisco:adaptive_security_appliance_software:8.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:adaptive_security_appliance_software:8.3\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:adaptive_security_appliance_software:8.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:adaptive_security_appliance_software:8.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-2128"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco",
"sources": [
{
"db": "BID",
"id": "66746"
}
],
"trust": 0.3
},
"cve": "CVE-2014-2128",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.0,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2014-2128",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-70067",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2014-2128",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201404-115",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-70067",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2014-2128",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-70067"
},
{
"db": "VULMON",
"id": "CVE-2014-2128"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001941"
},
{
"db": "NVD",
"id": "CVE-2014-2128"
},
{
"db": "CNNVD",
"id": "CNNVD-201404-115"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.47, 8.3 before 8.3(2.40), 8.4 before 8.4(7.3), 8.6 before 8.6(1.13), 9.0 before 9.0(3.8), and 9.1 before 9.1(3.2) allows remote attackers to bypass authentication via (1) a crafted cookie value within modified HTTP POST data or (2) a crafted URL, aka Bug ID CSCua85555. \nExploiting this issue could allow an attacker to bypass certain security restrictions and gain unauthenticated access to the SSL VPN Portal page. \nThis issue is tracked by Cisco Bug ID CSCua85555",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-2128"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001941"
},
{
"db": "BID",
"id": "66746"
},
{
"db": "VULHUB",
"id": "VHN-70067"
},
{
"db": "VULMON",
"id": "CVE-2014-2128"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-2128",
"trust": 2.9
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001941",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201404-115",
"trust": 0.7
},
{
"db": "CISCO",
"id": "20140409 MULTIPLE VULNERABILITIES IN CISCO ASA SOFTWARE",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "26490",
"trust": 0.6
},
{
"db": "BID",
"id": "66746",
"trust": 0.5
},
{
"db": "SEEBUG",
"id": "SSVID-62151",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-70067",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2014-2128",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-70067"
},
{
"db": "VULMON",
"id": "CVE-2014-2128"
},
{
"db": "BID",
"id": "66746"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001941"
},
{
"db": "NVD",
"id": "CVE-2014-2128"
},
{
"db": "CNNVD",
"id": "CNNVD-201404-115"
}
]
},
"id": "VAR-201404-0572",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-70067"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:21:21.808000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "cisco-sa-20140409-asa",
"trust": 0.8,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20140409-asa"
},
{
"title": "33624",
"trust": 0.8,
"url": "http://tools.cisco.com/security/center/viewalert.x?alertid=33624"
},
{
"title": "cisco-sa-20140409-asa",
"trust": 0.8,
"url": "http://www.cisco.com/cisco/web/support/jp/112/1122/1122330_cisco-sa-20140409-asa-j.html"
},
{
"title": "Cisco: Cisco Adaptive Security Appliance SSL VPN Authentication Bypass Vulnerability",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=cisco-sa-20140409-cve-2014-2128"
},
{
"title": "Cisco: Multiple Vulnerabilities in Cisco ASA Software",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=cisco-sa-20140409-asa"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2014-2128"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001941"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-287",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-70067"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001941"
},
{
"db": "NVD",
"id": "CVE-2014-2128"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20140409-asa"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2128"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2128"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/26490"
},
{
"trust": 0.3,
"url": "http://www.cisco.com/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/287.html"
},
{
"trust": 0.1,
"url": "https://www.securityfocus.com/bid/66746"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20140409-cve-2014-2128"
},
{
"trust": 0.1,
"url": "https://nmap.org/nsedoc/scripts/http-vuln-cve2014-2128.html"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-70067"
},
{
"db": "VULMON",
"id": "CVE-2014-2128"
},
{
"db": "BID",
"id": "66746"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001941"
},
{
"db": "NVD",
"id": "CVE-2014-2128"
},
{
"db": "CNNVD",
"id": "CNNVD-201404-115"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-70067"
},
{
"db": "VULMON",
"id": "CVE-2014-2128"
},
{
"db": "BID",
"id": "66746"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001941"
},
{
"db": "NVD",
"id": "CVE-2014-2128"
},
{
"db": "CNNVD",
"id": "CNNVD-201404-115"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-04-10T00:00:00",
"db": "VULHUB",
"id": "VHN-70067"
},
{
"date": "2014-04-10T00:00:00",
"db": "VULMON",
"id": "CVE-2014-2128"
},
{
"date": "2014-04-09T00:00:00",
"db": "BID",
"id": "66746"
},
{
"date": "2014-04-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-001941"
},
{
"date": "2014-04-10T04:34:51.007000",
"db": "NVD",
"id": "CVE-2014-2128"
},
{
"date": "2014-04-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201404-115"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-04-10T00:00:00",
"db": "VULHUB",
"id": "VHN-70067"
},
{
"date": "2023-08-15T00:00:00",
"db": "VULMON",
"id": "CVE-2014-2128"
},
{
"date": "2014-04-09T00:00:00",
"db": "BID",
"id": "66746"
},
{
"date": "2014-04-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-001941"
},
{
"date": "2023-08-15T15:14:43.030000",
"db": "NVD",
"id": "CVE-2014-2128"
},
{
"date": "2014-04-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201404-115"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201404-115"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco Adaptive Security Appliance Software SSL VPN Vulnerabilities that prevent authentication from being implemented",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-001941"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "authorization issue",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201404-115"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…