CVE-2014-2137 CRLF injection vulnerability in the web framework in Cisco Web Security Appliance (WSA) 7.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a c...
MediumCVSS 4.3
EPSS 0.95%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CRLF injection vulnerability in the web framework in Cisco Web Security Appliance (WSA) 7.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCuj61002.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco web security virtual appliance | <= 7.7 | No fix listed |
| cisco web security virtual appliance | = 7.1.0 | No fix listed |
| cisco web security virtual appliance | = 7.1.1 | No fix listed |
| cisco web security virtual appliance | = 7.1.2 | No fix listed |
| cisco web security virtual appliance | = 7.1.3 | No fix listed |
| cisco web security virtual appliance | = 7.1.4 | No fix listed |
| cisco web security virtual appliance | = 7.5.0 | No fix listed |
| cisco web security virtual appliance | = 7.5.1 | No fix listed |
| cisco web security appliance | All versions | No fix listed |
References
- 20140401 Cisco WSA HTTP Header Injection Vulnerability vendor-advisory
- tools.cisco.com vendor-advisory