CWE Code: 20
Vulnerability Type: privilege_escalation
CVSS Score: 8.5
CWE Name:  Improper Input Validation
Summary: cisco adaptive security appliance (asa) software 8.x before 8.2(5.48), 8.3 before 8.3(2.40), 8.4 before 8.4(7.9), 8.6 before 8.6(1.13), 9.0 before 9.0(4.1), and 9.1 before 9.1(4.3) does not properly process management-session information during privilege validation for ssl vpn portal connections, which allows remote authenticated users to gain privileges by establishing a clientless ssl vpn session and entering crafted urls, aka bug id cscul70099.
Access Authentication: SINGLE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2014-04-10
Last Modified Date: 2014-04-10