CVE-2014-2127
high · 8.5Cisco Adaptive Security Appliance (ASA) Software 8.x before 8.2(5.48), 8.3 before 8.3(2.40), 8.4 before 8.4(7.9), 8.6 before 8.6(1.13), 9.0 before 9.0(4.1), and 9.1 before 9.1(4.3) does not properly process management-session information during privilege validation for SSL VPN portal connections, which allows remote authenticated users to gain privileges by establishing a Clientless SSL VPN session and entering crafted URLs, aka Bug ID CSCul70099.
8.5
CVSS
11.5%
EPSS (exploit prob.)
96th
EPSS percentile
2014-04-10
Published
AV:N/AC:M/Au:S/C:C/I:C/A:C
Weaknesses
CWE-20
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| cisco | adaptive_security_appliance_software | 8.0 |
| cisco | adaptive_security_appliance_software | 8.1 |
| cisco | adaptive_security_appliance_software | 8.2 |
| cisco | adaptive_security_appliance_software | 8.3(1) |
| cisco | adaptive_security_appliance_software | 8.4 |
| cisco | adaptive_security_appliance_software | 8.6 |
| cisco | adaptive_security_appliance_software | 9.0 |
| cisco | adaptive_security_appliance_software | 9.1 |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2014-2127