CVE-2014-2137

Published: Apr 2, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

CRLF injection vulnerability in the web framework in Cisco Web Security Appliance (WSA) 7.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCuj61002.

Affected (9)

Products: Cisco: Web Security Appliance, Web Security Virtual Appliance

Cisco

2 products

Web Security Appliance

Web Security Virtual Appliance

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Cisco Web Security Appliance	All versions
Cisco Web Security Virtual Appliance	Up to 7.7
Cisco Web Security Virtual Appliance	Version 7.1.0
Cisco Web Security Virtual Appliance	Version 7.1.1
Cisco Web Security Virtual Appliance	Version 7.1.2
Cisco Web Security Virtual Appliance	Version 7.1.3
Cisco Web Security Virtual Appliance	Version 7.1.4
Cisco Web Security Virtual Appliance	Version 7.5.0
Cisco Web Security Virtual Appliance	Version 7.5.1