CVE-2013-5497

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

The authentication manager process in the web framework in Cisco Intrusion Prevention System (IPS) does not properly handle user tokens, which allows remote attackers to cause a denial of service (intermittent MainApp hang) via a crafted management-interface connection request, aka Bug ID CSCuf20148.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:N/A:P

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/97525
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5497Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=30913Vendor Advisory
http://www.securityfocus.com/bid/62517Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029057Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/87280
http://osvdb.org/97525
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5497Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=30913Vendor Advisory
http://www.securityfocus.com/bid/62517Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029057Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/87280

Timeline

Published: Sep 19, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-54985.0The PPTP-ALG component in CRS Carrier Grade Services Engine (CGSE) and ASR 9000 Integrated Service Module (ISM) in Cisco IOS XR allows remot CVE-2013-54995.7The remember feature in the DHCP server in Cisco IOS allows remote attackers to cause a denial of service (device reload) by acquiring a lea CVE-2013-55004.3Multiple cross-site scripting (XSS) vulnerabilities in the oraadmin service page in Cisco MediaSense allow remote attackers to inject arbitr CVE-2013-55014.3Cross-site scripting (XSS) vulnerability in the oraservice page in Cisco MediaSense allows remote attackers to inject arbitrary web script o CVE-2013-55025.0The web interface in Cisco MediaSense does not properly protect the client-server communication channel, which allows remote attackers to ob CVE-2013-55037.8The UDP process in Cisco IOS XR 4.3.1 does not free packet memory upon detecting full packet queues, which allows remote attackers to cause CVE-2013-55044.3Cross-site scripting (XSS) vulnerability in the Mobile Device Management (MDM) portal in Cisco Identity Services Engine (ISE) allows remote CVE-2013-55054.3Cross-site scripting (XSS) vulnerability in an administration page in Cisco Identity Services Engine (ISE) allows remote attackers to inject CVE-2013-55066.6The authorization functionality in Cisco Firewall Services Module (FWSM) 3.1.x and 3.2.x before 3.2(25) and 4.x before 4.1(13), when multipl CVE-2013-55077.1The IPsec implementation in Cisco Adaptive Security Appliance (ASA) Software 9.1 before 9.1(1.7), when an IPsec VPN tunnel is enabled, allow CVE-2013-55087.1The SQL*Net inspection engine in Cisco Adaptive Security Appliance (ASA) Software 7.x before 7.2(5.12), 8.x before 8.2(5.44), 8.3.x before 8 CVE-2013-550910.0The SSL implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0 before 9.0(2.6) and 9.1 before 9.1(2) allows remote attackers