CVE-2010-2629

The Cisco Content Services Switch (CSS) 11500 with software 8.20.4.02 and the Application Control Engine (ACE) 4710 with software A2(3.0)…

High7.5EPSS 1.5%

Published: 6 Jul 2010
Updated: 7 Aug 2024
Reserved: 6 Jul 2010
Assigned by: mitre

Description

The Cisco Content Services Switch (CSS) 11500 with software 8.20.4.02 and the Application Control Engine (ACE) 4710 with software A2(3.0) do not properly handle LF header terminators in situations where the GET line is terminated by CRLF, which allows remote attackers to conduct HTTP request smuggling attacks and possibly bypass intended header insertions via crafted header data, as demonstrated by an LF character between the ClientCert-Subject and ClientCert-Subject-CN headers. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1576.

Scores

CVSS scores of CVE-2010-2629, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	2.0	High7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS (exploitation in 30 days): 1.5% · top 26% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

Affected products

n/a
- affected n/a

References (5)

20100702 VSR Advisory: Multiple Cisco CSS / ACE Client Certificate and HTTP Header Manipulation Vulnerabilities (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
1024167 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
41315 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
http://www.vsecurity.com/resources/advisory/20100702-1/ (opens in a new tab)x_refsource_MISCx_transferred
1024168 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2010-2629](https://trackcve.app/badge/CVE-2010-2629.svg)](https://trackcve.app/cve/CVE-2010-2629)

Record last updated 7 Aug 2024, 02:39 UTC.