CVE-2009-3457

EPSS 4.2%

Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.

Affected products

n/a · n/a

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/10000unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://seclists.org/fulldisclosure/2009/Sep/0369.html http://secunia.com/advisories/36879 https://exchange.xforce.ibmcloud.com/vulnerabilities/53482 http://www.brainoverflow.org/advisories/cisco_ace_xml_gw_ip_disclosure.txt http://www.cisco.com/en/US/products/products_security_response09186a0080af8965.html http://www.securityfocus.com/archive/1/506716/100/0/threaded http://www.securityfocus.com/bid/36522 http://www.securitytracker.com/id?1022949 http://www.vupen.com/english/advisories/2009/2778