IP Disclosure Vulnerability in Cisco ACE XML Gateway and Web Application Firewall

CVE-2009-3457

Summary

The Cisco ACE XML Gateway and ACE Web Application Firewall before version 6.1 are susceptible to a vulnerability that allows remote attackers to extract sensitive internal IP address information. This situation can occur when an HTTP request lacks a proper handler, such as an OPTIONS request or a specially crafted GET request. The resulting error messages may inadvertently disclose the client's intranet IP address, potentially exposing the network to further attacks. This issue emphasizes the importance of securing application request handling.

References