CVE-2009-0470: XSS

Published Feb 6, 2009

Updated

Multiple cross-site scripting (XSS) vulnerabilities in the HTTP server in Cisco IOS 12.4(23) allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI under (1) level/15/exec/-/ or (2) exec/, a different vulnerability than CVE-2008-3821.

Affected Software

1 affected component

Cisco IOS=12.4\(23\)

Event History

Feb 6, 2009

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Data Sourced

via NVD·07:30 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which systems are exposed?

Cisco IOS devices running 12.4(23) with the HTTP server accessible to remote attackers are exposed to the affected request paths.

Does exploitation require authentication or user interaction?

The provided severity vector indicates network access is required, exploitation has medium complexity, and no authentication is required. The recorded impact is limited to integrity; no confidentiality or availability impact is listed.

CVE-2009-0470: XSS

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed?

Does exploitation require authentication or user interaction?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed?

Does exploitation require authentication or user interaction?