Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 and 3.x before 3.0 MR8 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a version downgrade by using (1) ActiveX or (2) Java components to offer signed code that corresponds to an older software release, aka Bug ID CSCtw48681.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Cisco AnyConnect Secure Mobility Client ‘WebLaunch’功能安全漏洞
Vulnerability Description
Cisco AnyConnect Secure Mobility是一个安全的企业移动解决方案。 Cisco AnyConnect Secure Mobility Client 2.5 MR6之前的2.x版本和3.0 MR8之前的3.x版本中的WebLaunch功能中的VPN下载器的实现上存在漏洞，该漏洞源于未比较安装软件时间戳提供的软件时间戳。远程攻击者可利用该漏洞通过使用(1)ActiveX或(2)Java组件提供相应的旧软件的签署代码强制版本降级。又名 Bug ID CSCtw48681。
CVSS Information
N/A
Vulnerability Type
N/A