CVE-2015-4288

The LDAP implementation on the Cisco Web Security Appliance (WSA) 8.5.0-000, Email Security Appliance (ESA) 8.5.7-042, and Content Security Management Appliance (SMA) 8.3.6-048 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, aka Bug IDs CSCuo29561, CSCuv40466, and CSCuv40470.

Severity	MEDIUM
CVSS	4.3
CWE	CWE-310
KEV
Published	10 years ago
Modified	1 week ago

Related Products

Product	Advisory
Cisco Web Security Appliance (WSA)	Cisco-SA-20150724-CVE-2015-4288
Cisco Secure Web Appliance	Cisco-SA-20150724-CVE-2015-4288
Cisco Secure Email and Web Manager	Cisco-SA-20150724-CVE-2015-4288
Cisco Secure Email	Cisco-SA-20150724-CVE-2015-4288
Cisco Email Security Appliance (ESA)	Cisco-SA-20150724-CVE-2015-4288
Cisco Content Security Management Appliance (SMA)	Cisco-SA-20150724-CVE-2015-4288