CVE-2009-0470: XSS
Published Feb 6, 2009
·Updated
Multiple cross-site scripting (XSS) vulnerabilities in the HTTP server in Cisco IOS 12.4(23) allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI under (1) level/15/exec/-/ or (2) exec/, a different vulnerability than CVE-2008-3821.
Affected Software
1 affected component
Cisco IOS=12.4\(23\)
Event History
Feb 6, 2009
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Data Sourced
via NVD·07:30 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Which systems are exposed?
Cisco IOS devices running 12.4(23) with the HTTP server accessible to remote attackers are exposed to the affected request paths.
2
Does exploitation require authentication or user interaction?
The provided severity vector indicates network access is required, exploitation has medium complexity, and no authentication is required. The recorded impact is limited to integrity; no confidentiality or availability impact is listed.