Unscored severity · published Apr 2, 2014
CVE-2014-2137
CRLF injection vulnerability in the web framework in Cisco Web Security Appliance (WSA) 7.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct…
–
CVSS
0.9%
EPSS
No
On KEV
Description
CRLF injection vulnerability in the web framework in Cisco Web Security Appliance (WSA) 7.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCuj61002.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
Web Security Appliance · Cisco
All versions, or not specified · source: NVD
WS
Web Security Virtual Appliance · Cisco
through 7.7; 7.1.0; 7.1.1; 7.1.2; 7.1.3; 7.1.4; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2137
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2137
Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2137
Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=33608
More from Web Security Appliance
9.8
CVE-2023-20032
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and…
8.8
CVE-2021-1359
A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform command injection…
8.8
CVE-2019-15956
A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform an…
8.6
CVE-2019-1886
A vulnerability in the HTTPS decryption feature of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition
8.6
CVE-2018-0410
A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliances could allow an unauthenticated, remote attacker to exhaust system memory…