CVE-2019-1714

Summary

CVE	CVE-2019-1714
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2019-05-03 17:29:00 UTC
Updated	2023-08-15 15:24:00 UTC
Description	A vulnerability in the implementation of Security Assertion Markup Language (SAML) 2.0 Single Sign-On (SSO) for Clientless SSL VPN (WebVPN) and AnyConnect Remote Access VPN in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to successfully establish a VPN session to an affected device. The vulnerability is due to improper credential management when using NT LAN Manager (NTLM) or basic authentication. An attacker could exploit this vulnerability by opening a VPN session to an affected device after another VPN user has successfully authenticated to the affected device via SAML SSO. A successful exploit could allow the attacker to connect to secured networks behind the affected device.

Risk And Classification

Problem Types: NVD-CWE-Other

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Cisco	Adaptive Security Appliance Software	All	All	All	All
Operating System	Cisco	Adaptive Security Appliance Software	All	All	All	All
Application	Cisco	Adaptive Security Appliance Software	All	All	All	All
Application	Cisco	Adaptive Security Virtual Appliance	-	All	All	All
Hardware	Cisco	Adaptive Security Virtual Appliance	-	All	All	All
Hardware	Cisco	Adaptive Security Virtual Appliance	-	All	All	All
Hardware	Cisco	Asa-5506-x	-	All	All	All
Hardware	Cisco	Asa-5506-x	-	All	All	All
Hardware	Cisco	Asa-5506h-x	-	All	All	All
Hardware	Cisco	Asa-5506h-x	-	All	All	All
Hardware	Cisco	Asa-5506w-x	-	All	All	All
Hardware	Cisco	Asa-5506w-x	-	All	All	All
Hardware	Cisco	Asa-5508-x	-	All	All	All
Hardware	Cisco	Asa-5508-x	-	All	All	All
Hardware	Cisco	Asa-5516-x	-	All	All	All
Hardware	Cisco	Asa-5516-x	-	All	All	All
Hardware	Cisco	Asa-5525-x	-	All	All	All
Hardware	Cisco	Asa-5525-x	-	All	All	All
Hardware	Cisco	Asa-5545-x	-	All	All	All
Hardware	Cisco	Asa-5545-x	-	All	All	All
Hardware	Cisco	Asa-5555-x	-	All	All	All
Hardware	Cisco	Asa-5555-x	-	All	All	All
Hardware	Cisco	Firepower 2110	-	All	All	All
Hardware	Cisco	Firepower 2110	-	All	All	All
Hardware	Cisco	Firepower 2120	-	All	All	All
Hardware	Cisco	Firepower 2120	-	All	All	All
Hardware	Cisco	Firepower 2130	-	All	All	All
Hardware	Cisco	Firepower 2130	-	All	All	All
Hardware	Cisco	Firepower 2140	-	All	All	All
Hardware	Cisco	Firepower 2140	-	All	All	All
Hardware	Cisco	Firepower 4100	-	All	All	All
Hardware	Cisco	Firepower 4100	-	All	All	All
Hardware	Cisco	Firepower 9300	-	All	All	All
Hardware	Cisco	Firepower 9300	-	All	All	All
Application	Cisco	Firepower Threat Defense	All	All	All	All
Application	Cisco	Firepower Threat Defense	All	All	All	All
Hardware	Cisco	Isa 3000	-	All	All	All
Hardware	Cisco	Isa 3000	-	All	All	All

References

Reference	Source	Link	Tags
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software VPN SAML Authentication Bypass Vulnerability	CISCO	tools.cisco.com	Vendor Advisory
Multiple Cisco Products CVE-2019-1714 Authentication Bypass Vulnerability	BID	www.securityfocus.com	Third Party Advisory, VDB Entry
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

317006 Cisco Adaptive Security Appliance (ASA) Software VPN SAML Authentication Bypass Vulnerability(cisco-sa-20190501-asaftd-saml-vpn)
317008 Cisco Firepower Threat Defense Software Virtual Private Network(VPN) Security Assertion Markup Language(SAML) Authentication Bypass Vulnerability(cisco-sa-20190501-asaftd-saml-vpn)