CVE-2009-1162: XSS
Published Jun 5, 2009
·Updated
Cross-site scripting (XSS) vulnerability in the Spam Quarantine login page in Cisco IronPort AsyncOS before 6.5.2 on Series C, M, and X appliances allows remote attackers to inject arbitrary web script or HTML via the referrer parameter.
Affected Software
16 affected components
Cisco IronPort AsyncOS=6.0.0-754
Cisco IronPort AsyncOS=6.0.0-757
Cisco IronPort AsyncOS=6.1.0-301
Cisco IronPort AsyncOS=6.1.0-304
Cisco IronPort AsyncOS=6.1.0-306
Cisco IronPort AsyncOS=6.1.0-307
Cisco IronPort AsyncOS=6.1.5-110
Cisco IronPort AsyncOS=6.1.6-003
Cisco IronPort AsyncOS=6.3.5-003
Cisco IronPort AsyncOS=6.3.6-003
Cisco IronPort AsyncOS=6.5.0-405
Cisco IronPort AsyncOS=6.5.1-005
Cisco IronPort AsyncOS=6.6.4.0-273
Cisco Ironport Email Security Appliances=c
Cisco Ironport Email Security Appliances=m
Cisco Ironport Email Security Appliances=x
Event History
Jun 5, 2009
CVE Published
via MITRE·03:25 PM
Data Sourced
via MITRE·03:25 PM
Description
Data Sourced
04:00 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2009-1162?
CVE-2009-1162 is classified as a medium severity vulnerability.
2
How do I fix CVE-2009-1162?
To fix CVE-2009-1162, upgrade to Cisco IronPort AsyncOS version 6.5.2 or later.
3
Which systems are affected by CVE-2009-1162?
CVE-2009-1162 affects various versions of Cisco IronPort AsyncOS prior to 6.5.2 on Series C, M, and X appliances.
4
What kind of attack can exploit CVE-2009-1162?
CVE-2009-1162 can be exploited for cross-site scripting (XSS) attacks via the referrer parameter.
5
Is there a workaround for CVE-2009-1162?
Implementing input validation on the referrer parameter can help mitigate the risk of CVE-2009-1162.