Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The Cisco Content Services Switch (CSS) 11500 with software before 8.20.4.02 and the Application Control Engine (ACE) 4710 with software before A2(3.0) do not properly handle use of LF, CR, and LFCR as alternatives to the standard CRLF sequence between HTTP headers, which allows remote attackers to bypass intended header insertions or conduct HTTP request smuggling attacks via crafted header data, as demonstrated by LF characters preceding ClientCert-Subject and ClientCert-Subject-CN headers, aka Bug ID CSCta04885.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Cisco CSS HTTP请求头输入验证漏洞
Vulnerability Description
Cisco CSS 11500内容服务交换机是用于为数据中心提供强壮可升级网络服务(4-7层)的负载均衡设备。 装有8.20.4.02之前版本软件的Cisco内容服务交换机(CSS)11500以及装有A2(3.0)之前版本软件的应用控制引擎(ACE)4710不能很好的处理LF,CR以及LFCR代替HTTP头之间标准CRLF序列的使用，远程攻击者可以利用伪造头数据绕过预期的头插入或者进行HTTP请求窃取攻击，例如在LF字符前伪造ClientCert-Subject 和ClientCert-Subject-C
CVSS Information
N/A
Vulnerability Type
N/A