What is the severity of CVE-2009-4455?

CVE-2009-4455 is considered a high severity vulnerability due to its potential to allow authenticated users to access unauthorized backend servers.

How do I fix CVE-2009-4455?

To fix CVE-2009-4455, update your Cisco ASA 5500 Series Adaptive Security Appliance to a version that addresses the vulnerability.

What devices are affected by CVE-2009-4455?

CVE-2009-4455 affects Cisco ASA 5500 Series devices running versions 7.0 to 8.2.

Is there a workaround for CVE-2009-4455?

A recommended workaround for CVE-2009-4455 is to review and modify the default configuration settings of the Cisco ASA to restrict backend server access.

Vulnerability/
CVE-2009-4455

medium

6.5

CWE

264

29/12/2009

7/8/2024

CVE-2009-4455

First published: Tue Dec 29 2009(Updated: )

The default configuration of Cisco ASA 5500 Series Adaptive Security Appliance (Cisco ASA) 7.0, 7.1, 7.2, 8.0, 8.1, and 8.2 allows portal traffic to access arbitrary backend servers, which might allow remote authenticated users to bypass intended access restrictions and access unauthorized web sites via a crafted URL obfuscated with ROT13 and a certain encoding. NOTE: this issue was originally reported as a vulnerability related to lack of restrictions to URLs listed in the Cisco WebVPN bookmark component, but the vendor states that "The bookmark feature is not a security feature."

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
Cisco Adaptive Security Appliance 5500	=8.1
Cisco Adaptive Security Appliance 5500	=7.0
Cisco Adaptive Security Appliance 5500	=7.1
Cisco Adaptive Security Appliance 5500	=7.2
Cisco Adaptive Security Appliance 5500	=8.0
Cisco Adaptive Security Appliance 5500	=8.2

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2009-4455?
CVE-2009-4455 is considered a high severity vulnerability due to its potential to allow authenticated users to access unauthorized backend servers.
How do I fix CVE-2009-4455?
To fix CVE-2009-4455, update your Cisco ASA 5500 Series Adaptive Security Appliance to a version that addresses the vulnerability.
What devices are affected by CVE-2009-4455?
CVE-2009-4455 affects Cisco ASA 5500 Series devices running versions 7.0 to 8.2.
What type of access does CVE-2009-4455 allow?
CVE-2009-4455 allows remote authenticated users to bypass intended access restrictions and potentially access unauthorized websites.
Is there a workaround for CVE-2009-4455?
A recommended workaround for CVE-2009-4455 is to review and modify the default configuration settings of the Cisco ASA to restrict backend server access.

collector/nvd-historical
collector/nvd-index
agent/references
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/weakness
agent/author
agent/severity
agent/tags
agent/description
agent/first-publish-date
agent/event
agent/source
vendor/cisco
canonical/cisco adaptive security appliance 5500
version/cisco adaptive security appliance 5500/8.1
version/cisco adaptive security appliance 5500/7.0
version/cisco adaptive security appliance 5500/7.1
version/cisco adaptive security appliance 5500/7.2
version/cisco adaptive security appliance 5500/8.0
version/cisco adaptive security appliance 5500/8.2

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.