20141008 Multiple Vulnerabilities in Cisco ASA SoftwareVendor advisory
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141008-asa CVE-2014-3393
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Improper Authentication
Record summary
CVE-2014-3393 has a selected CVSS score of 4.3.
Description
The Clientless SSL VPN portal customization framework in Cisco ASA Software 8.2 before 8.2(5.51), 8.3 before 8.3(2.42), 8.4 before 8.4(7.23), 8.6 before 8.6(1.14), 9.0 before 9.0(4.24), 9.1 before 9.1(5.12), and 9.2 before 9.2(2.4) does not properly implement authentication, which allows remote attackers to modify RAMFS customization objects via unspecified vectors, as demonstrated by inserting XSS sequences or capturing credentials, aka Bug ID CSCup36829.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Sep 28, 2016 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)Browse Cisco / Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | VulnCheck | Version data not supplied | |
References
2nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2014-3393