CVE-2014-2137: Input Validation
Published Apr 2, 2014
·Updated
CRLF injection vulnerability in the web framework in Cisco Web Security Appliance (WSA) 7.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCuj61002.
Affected Software
9 affected components
Cisco Web Security Virtual Appliance<=7.7
Cisco Web Security Virtual Appliance=7.1.0
Cisco Web Security Virtual Appliance=7.1.1
Cisco Web Security Virtual Appliance=7.1.2
Cisco Web Security Virtual Appliance=7.1.3
Cisco Web Security Virtual Appliance=7.1.4
Cisco Web Security Virtual Appliance=7.5.0
Cisco Web Security Virtual Appliance=7.5.1
Cisco Web Security Appliance
Event History
Apr 2, 2014
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Data Sourced
via NVD·03:58 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2137?
CVE-2014-2137 is classified as a medium severity vulnerability.
2
How do I fix CVE-2014-2137?
To fix CVE-2014-2137, upgrade to a version of Cisco Web Security Appliance that is later than 7.7.
3
Which versions of Cisco Web Security Appliance are affected by CVE-2014-2137?
CVE-2014-2137 affects Cisco Web Security Appliance versions 7.7 and earlier, including versions 7.1.0 to 7.5.1.
4
What type of attacks can be performed through CVE-2014-2137?
CVE-2014-2137 allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks.
5
Is there a workaround for CVE-2014-2137?
There is no documented workaround for CVE-2014-2137, so applying the security update is the recommended approach.