CVE-2009-1220: XSS
Cross-site scripting (XSS) vulnerability in +webvpn+/index.html in WebVPN on the Cisco Adaptive Security Appliances (ASA) 5520 with software 7.2(4)30 and earlier 7.2 versions including 7.2(2)22, and 8.0(4)28 and earlier 8.0 versions, when clientless mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the Host HTTP header.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable clientless mode on affected ASA WebVPN instances to mitigate the XSS vulnerability in +webvpn+/index.html that allows injection via the Host HTTP header.
Cisco Adaptive Security Appliance (ASA) WebVPN clientless mode = disabled - Operational
Inventory Cisco Adaptive Security Appliance (ASA) devices and identify ASA 5520 devices running software 7.2(4)30 and earlier 7.2 versions (including 7.2(2)22), and 8.0(4)28 and earlier 8.0 versions; verify whether WebVPN clientless mode is enabled on those devices.
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1220?
CVE-2009-1220 is classified as a medium-severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2009-1220?
To mitigate CVE-2009-1220, upgrade the Cisco Adaptive Security Appliance to a version that is not vulnerable.
What systems are affected by CVE-2009-1220?
CVE-2009-1220 affects Cisco Adaptive Security Appliances 5520 running software versions 7.2(4)30 and earlier, including 7.2(2)22 and 8.0(4)28.
What type of vulnerability is CVE-2009-1220?
CVE-2009-1220 is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML.
When was CVE-2009-1220 disclosed?
CVE-2009-1220 was publicly disclosed in March 2009.