VULNERABILITY INTELLIGENCE

CVE-2014-3399

CVSS score5.5 MEDIUM
EPSS probability1.03%
CISA KEVNot currently listed
Published2014-10-07
Last modified2026-06-17
CVSS vectorAV:N/AC:L/Au:S/C:N/I:P/A:P

Description

The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.2(.2.4) and earlier does not properly manage session information during creation of a SharePoint handler, which allows remote authenticated users to overwrite arbitrary RAMFS cache files or inject Lua programs, and consequently cause a denial of service (portal outage or system reload), via crafted HTTP requests, aka Bug ID CSCup54208.

Weakness classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references