CVE-2008-0533: XSS
First published: Fri Mar 14 2008(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution Engine allow remote attackers to inject arbitrary web script or HTML via an argument located immediately after the Help argument, and possibly unspecified other vectors.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco ACS for Windows | ||
| Cisco Secure ACS Solution Engine | ||
| Cisco User Changeable Password | =4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.recurity-labs.com/content/pub/RecurityLabs_Cisco_ACS_UCP_advisory.txt
- http://www.cisco.com/en/US/products/products_security_advisory09186a008095f0c4.shtml
- http://www.securityfocus.com/bid/28222
- http://securitytracker.com/id?1019607
- http://secunia.com/advisories/29351
- http://securityreason.com/securityalert/3743
- http://www.vupen.com/english/advisories/2008/0868
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41156
- http://www.securityfocus.com/archive/1/489463/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2008-0533?
CVE-2008-0533 is classified as a medium severity cross-site scripting vulnerability.
How do I fix CVE-2008-0533?
To fix CVE-2008-0533, upgrade the Cisco Secure Access Control Server to a version that addresses this vulnerability.
What software is affected by CVE-2008-0533?
CVE-2008-0533 affects Cisco Secure ACS Solution Engine, Cisco ACS for Windows, and the Cisco User Changeable Password before version 4.2.
Can CVE-2008-0533 be exploited remotely?
Yes, CVE-2008-0533 can be exploited remotely by attackers to inject arbitrary web scripts.
What impact does CVE-2008-0533 have on affected systems?
The impact of CVE-2008-0533 includes the potential for attackers to perform unauthorized actions through the execution of injected scripts.
- agent/type
- agent/softwarecombine
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/cisco
- canonical/cisco secure acs solution engine
- canonical/cisco user changeable password
- version/cisco user changeable password/4.1
- canonical/cisco acs for windows