Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2009-4455: Cisco ASA lets VPN portal reach any internal server
CVE-2009-4455 · published 16 years ago
Summary
The default settings on Cisco ASA 5500 series firewalls let users of the web‑based VPN portal request any address behind the firewall. An attacker could craft a special link and bypass the intended restrictions, gaining access to sites they should not see. Update the ASA configuration to lock down portal URLs or apply the vendor’s recommended hardening steps.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| cisco | adaptive_security_appliance_5500 |
7.0 7.1 7.2 8.0 8.1 8.2 cpe:2.3:h:cisco:adaptive_security_appliance_5500:7.0:*:*:*:*:*:*:* |
Original advisory text
The default configuration of Cisco ASA 5500 Series Adaptive Security Appliance (Cisco ASA) 7.0, 7.1, 7.2, 8.0, 8.1, and 8.2 allows portal traffic to access arbitrary backend servers, which might al...
The default configuration of Cisco ASA 5500 Series Adaptive Security Appliance (Cisco ASA) 7.0, 7.1, 7.2, 8.0, 8.1, and 8.2 allows portal traffic to access arbitrary backend servers, which might allow remote authenticated users to bypass intended access restrictions and access unauthorized web sites via a crafted URL obfuscated with ROT13 and a certain encoding. NOTE: this issue was originally reported as a vulnerability related to lack of restrictions to URLs listed in the Cisco WebVPN bookmark component, but the vendor states that "The bookmark feature is not a security feature."
References
- http://osvdb.org/61132
- http://secunia.com/advisories/37710 Vendor Advisory
- http://tools.cisco.com/security/center/viewAlert.x?alertId=19609 Vendor Advisory
- http://www.securityfocus.com/archive/1/508530/100/0/threaded
- http://www.securitytracker.com/id?1023368
- http://www.vupen.com/english/advisories/2009/3577 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
6.5
Medium
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published29 Dec 2009
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2009-4455 · NVD
Track software like this
Free during beta