CVE-2017-6752
A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) 9.3(3) and 9.6(2) could allow an unauthenticated, remot…
Published 9 y ago · modified 4 mo ago · JSON
Summary
A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) 9.3(3) and 9.6(2) could allow an unauthenticated, remote attacker to determine valid usernames. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to the interaction between Lightweight Directory Access Protocol (LDAP) and SSL Connection Profile when they are configured together. An attacker could exploit the vulnerability by performing a username enumeration attack to the IP address of the device. An exploit could allow the attacker to determine valid usernames. Cisco Bug IDs: CSCvd47888.
Exploit prediction (EPSS)
3.21% probability of exploitation in the next 30 days, higher than 88% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- n/a Cisco Adaptive Security Appliance
Classification
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
- quickview.cloudapps.cisco.com /quickview/bug/CSCvd47888 · x_refsource_CONFIRM, x_transferred
- tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-asa2 · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1039057 · vdb-entry, x_refsource_SECTRACK, x_transferred
- securityfocus.com /bid/100113 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2017-6752
- NVD: CVE-2017-6752
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.