4.3

CVE-2014-3289

Exploit
Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0, Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier, and Content Security Management Appliance (SMA) 8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, as demonstrated by the date_range parameter to monitor/reports/overview on the IronPort ESA, aka Bug IDs CSCun07998, CSCun07844, and CSCun07888.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Ironport Asyncos Version <= 8.0
Cisco ≫ Ironport Asyncos Version <= 8.3
Cisco ≫ Ironport Asyncos Version8.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.43% 0.821
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://packetstormsecurity.com/files/127004/Cisco-Ironport-Email-Security-Virtual-Appliance-8.0.0-671-XSS.html
http://seclists.org/fulldisclosure/2014/Jun/57
Third Party Advisory
Exploit
VDB Entry
http://secunia.com/advisories/58296
Permissions Required
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3289
Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=34569
Vendor Advisory
http://www.kb.cert.org/vuls/id/613308
http://www.securityfocus.com/bid/67943
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1030407
Third Party Advisory
VDB Entry