CVE-2014-2138

CRLF injection vulnerability in the web framework in Cisco Security Manager 4.2 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCun82349.

Published: Apr 2, 2014
Updated: Nov 9, 2025
CVE: CVE-2014-2138
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

CWE-20

Affected Software
References

Software	From	Fixed in
cisco / security_manager	3.3	3.3.x
cisco / security_manager	4.0.1-sp1	4.0.1-sp1.x
cisco / security_manager	4.0	4.0.x
cisco / security_manager	3.3.1-sp1	3.3.1-sp1.x
cisco / security_manager	3.1.1-sp3	3.1.1-sp3.x
cisco / security_manager	3.2	3.2.x
cisco / security_manager	3.2.2-sp2	3.2.2-sp2.x
cisco / security_manager	3.2.2	3.2.2.x
cisco / security_manager	3.3-sp1	3.3-sp1.x
cisco / security_manager	3.2-sp1	3.2-sp1.x
cisco / security_manager	-	4.2.x
cisco / security_manager	3.3.1-sp3	3.3.1-sp3.x
cisco / security_manager	3.2.1-sp1	3.2.1-sp1.x
cisco / security_manager	4.1-sp1	4.1-sp1.x
cisco / security_manager	3.2.2-sp4	3.2.2-sp4.x
cisco / security_manager	3.1	3.1.x
cisco / security_manager	3.2.1	3.2.1.x
cisco / security_manager	4.0.1	4.0.1.x
cisco / security_manager	4.1	4.1.x
cisco / security_manager	3.3.1-sp2	3.3.1-sp2.x
cisco / security_manager	3.2.2-sp1	3.2.2-sp1.x
cisco / security_manager	3.0.2	3.0.2.x
cisco / security_manager	3.1.1	3.1.1.x
cisco / security_manager	3.3-sp2	3.3-sp2.x
cisco / security_manager	4.0-sp1	4.0-sp1.x
cisco / security_manager	3.2.2-sp3	3.2.2-sp3.x
cisco / security_manager	4.1-sp2	4.1-sp2.x
cisco / security_manager	3.3.1	3.3.1.x
cisco / security_manager	3.2-sp2	3.2-sp2.x
cisco / security_manager	4.0.1-sp2	4.0.1-sp2.x
cisco / security_manager	3.3.1-sp4	3.3.1-sp4.x

Vulnerability Database

313,359

CVE-2014-2138

Deep Security Visibility Without the Complexity