CVE-2018-15465
Description
A vulnerability in the authorization subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, but unprivileged (levels 0 and 1), remote attacker to perform privileged actions by using the web management interface. The vulnerability is due to improper validation of user privileges when using the web management interface. An attacker could exploit this vulnerability by sending specific HTTP requests via HTTPS to an affected device as an unprivileged user. An exploit could allow the attacker to retrieve files (including the running configuration) from the device or to upload and replace software images on the device.
How to fix
- cisco adaptive_security_appliance_software9.4.4.29, 9.6.4.20, 9.8.3.18, 9.9.2.36, 9.10.1.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco adaptive_security_appliance_software | v < 9.4.4.29, 9.5 ≤ v < 9.6.4.20, 9.7 ≤ v < 9.8.3.18, 9.9 ≤ v < 9.9.2.36, 9.10 ≤ v < 9.10.1.7 | 9.4.4.29, 9.6.4.20, 9.8.3.18, 9.9.2.36, 9.10.1.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.