Description
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an improper input validation vulnerability when HTTP requests process URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| Cisco Adaptive Security Appliance (ASA) Software | Cisco / Cisco Adaptive Security Appliance (ASA) Software | >= unspecified, < 9.6.4.42 | affected |
| Cisco Adaptive Security Appliance (ASA) Software | Cisco / Cisco Adaptive Security Appliance (ASA) Software | >= unspecified, < 9.8.4.20 | affected |
| Cisco Adaptive Security Appliance (ASA) Software | Cisco / Cisco Adaptive Security Appliance (ASA) Software | >= unspecified, < 9.9.2.74 | affected |
| Cisco Adaptive Security Appliance (ASA) Software | Cisco / Cisco Adaptive Security Appliance (ASA) Software | >= unspecified, < 9.10.1.42 | affected |
| Cisco Adaptive Security Appliance (ASA) Software | Cisco / Cisco Adaptive Security Appliance (ASA) Software | >= unspecified, < 9.13.1.10 | affected |
| Cisco Adaptive Security Appliance (ASA) Software | Cisco / Cisco Adaptive Security Appliance (ASA) Software | >= unspecified, < 9.14.1.10 | affected |