CVE-2009-3457
Last modified
CVE-2009-3457 is a vulnerability of currently unknown severity. Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.. EPSS estimates a 4.19% chance of exploitation in the next 30 days.
Description
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Ace Web Application Firewall | <= 6.0\(3\) |
| Cisco | Ace Web Application Firewall | 6.0\(0\) |
| Cisco | Ace Web Application Firewall | 6.0\(1\) |
| Cisco | Ace Web Application Firewall | 6.0\(2\) |
| Cisco | Ace Xml Gateway | <= 6.0\(3\) |
| Cisco | Ace Xml Gateway | 6.0\(0\) |
| Cisco | Ace Xml Gateway | 6.0\(1\) |
| Cisco | Ace Xml Gateway | 6.0\(2\) |
References
- http://seclists.org/fulldisclosure/2009/Sep/0369.htmlExploit, Patch
- http://seclists.org/fulldisclosure/2009/Sep/0369.htmlExploit, Patch
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2009-3457?
How severe is CVE-2009-3457?
How do I fix CVE-2009-3457?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2009
- CVE-2009-3451Directory traversal vulnerability in WebCoreModule.ashx in R…
- CVE-2009-3452WebCoreModule.ashx in RADactive I-Load before 2008.2.5.0 all…
- CVE-2009-3453Multiple cross-site scripting (XSS) vulnerabilities in IBM L…
- CVE-2009-3454Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2009-3455Apple Safari, possibly before 4.0.3, on Mac OS X does not pr…
- CVE-2009-3456Google Chrome, possibly 3.0.195.21 and earlier, does not pro…
- CVE-2009-3458Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7,…
- CVE-2009-3459Heap-based buffer overflow in Adobe Reader and Acrobat 7.x b…8.8
- CVE-2009-3460Adobe Acrobat 9.x before 9.2, 8.x before 8.1.7, and possibly…
- CVE-2009-3461Unspecified vulnerability in Adobe Acrobat 9.x before 9.2 al…
- CVE-2009-3462Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7,…
- CVE-2009-3463Array index error in Adobe Shockwave Player before 11.5.2.60…
Are you affected by CVE-2009-3457?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST