CVE-2009-3457

Published: Sep 29, 2009Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.

Affected (8)

Products: Cisco: Ace Web Application Firewall, Ace Xml Gateway

2 products

Ace Web Application Firewall

Ace Xml Gateway

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Cisco Ace Web Application Firewall	Up to 6.0\(3\)
Cisco Ace Web Application Firewall	Version 6.0(0)
Cisco Ace Web Application Firewall	Version 6.0(1)
Cisco Ace Web Application Firewall	Version 6.0(2)
Cisco Ace Xml Gateway	Up to 6.0\(3\)
Cisco Ace Xml Gateway	Version 6.0(0)
Cisco Ace Xml Gateway	Version 6.0(1)
Cisco Ace Xml Gateway	Version 6.0(2)

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (18)

http://seclists.org/fulldisclosure/2009/Sep/0369.html

Source: cve@mitre.org

ExploitPatch

http://secunia.com/advisories/36879

Source: cve@mitre.org

http://www.brainoverflow.org/advisories/cisco_ace_xml_gw_ip_disclosure.txt

Source: cve@mitre.org

Exploit

http://www.cisco.com/en/US/products/products_security_response09186a0080af8965.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/506716/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/36522

Source: cve@mitre.org

http://www.securitytracker.com/id?1022949

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/2778

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/53482

Source: cve@mitre.org

http://seclists.org/fulldisclosure/2009/Sep/0369.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

http://secunia.com/advisories/36879

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.brainoverflow.org/advisories/cisco_ace_xml_gw_ip_disclosure.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.cisco.com/en/US/products/products_security_response09186a0080af8965.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/506716/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/36522

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1022949

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2009/2778

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/53482

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.