CVE-2014-2138

Published: Apr 2, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

CRLF injection vulnerability in the web framework in Cisco Security Manager 4.2 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCun82349.

Affected (31)

Products: Cisco: Security Manager

Cisco

1 product

Security Manager

Configuration A

31 vulnerable

Vulnerable Software	Affected Versions
Cisco Security Manager	Up to 4.2
Cisco Security Manager	Version 3.0.2
Cisco Security Manager	Version 3.1.1
Cisco Security Manager	Version 3.1.1 sp3
Cisco Security Manager	Version 3.1
Cisco Security Manager	Version 3.2.1
Cisco Security Manager	Version 3.2.1 sp1
Cisco Security Manager	Version 3.2.2
Cisco Security Manager	Version 3.2.2 sp1
Cisco Security Manager	Version 3.2.2 sp2
Cisco Security Manager	Version 3.2.2 sp3
Cisco Security Manager	Version 3.2.2 sp4
Cisco Security Manager	Version 3.2
Cisco Security Manager	Version 3.2 sp1
Cisco Security Manager	Version 3.2 sp2
Cisco Security Manager	Version 3.3.1
Cisco Security Manager	Version 3.3.1 sp1
Cisco Security Manager	Version 3.3.1 sp2
Cisco Security Manager	Version 3.3.1 sp3
Cisco Security Manager	Version 3.3.1 sp4
Cisco Security Manager	Version 3.3
Cisco Security Manager	Version 3.3 sp1
Cisco Security Manager	Version 3.3 sp2
Cisco Security Manager	Version 4.0.1
Cisco Security Manager	Version 4.0.1 sp1
Cisco Security Manager	Version 4.0.1 sp2
Cisco Security Manager	Version 4.0
Cisco Security Manager	Version 4.0 sp1
Cisco Security Manager	Version 4.1
Cisco Security Manager	Version 4.1 sp1
Cisco Security Manager	Version 4.1 sp2