CVE-2009-1220: XSS
First published: Wed Apr 01 2009(Updated: )
Cross-site scripting (XSS) vulnerability in +webvpn+/index.html in WebVPN on the Cisco Adaptive Security Appliances (ASA) 5520 with software 7.2(4)30 and earlier 7.2 versions including 7.2(2)22, and 8.0(4)28 and earlier 8.0 versions, when clientless mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the Host HTTP header.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Puppet Cisco IOS | =7.2\(2\)22 | |
| Cisco Adaptive Security Appliance Software | =5520 | |
| Cisco IOS | =7.2\(2\)22 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/34307
- http://archives.neohapsis.com/archives/fulldisclosure/2009-03/0478.html
- http://www.securityfocus.com/archive/1/502932
- http://www.securitytracker.com/id?1022122
- http://www.vupen.com/english/advisories/2009/1169
- http://tools.cisco.com/security/center/viewAlert.x?alertId=17950
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49528
- http://www.securityfocus.com/archive/1/502313/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2009-1220?
CVE-2009-1220 is classified as a medium-severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2009-1220?
To mitigate CVE-2009-1220, upgrade the Cisco Adaptive Security Appliance to a version that is not vulnerable.
What systems are affected by CVE-2009-1220?
CVE-2009-1220 affects Cisco Adaptive Security Appliances 5520 running software versions 7.2(4)30 and earlier, including 7.2(2)22 and 8.0(4)28.
What type of vulnerability is CVE-2009-1220?
CVE-2009-1220 is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML.
When was CVE-2009-1220 disclosed?
CVE-2009-1220 was publicly disclosed in March 2009.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/weakness
- collector/nvd-historical
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- vendor/cisco
- canonical/puppet cisco ios
- version/puppet cisco ios/7.2\(2\)22
- canonical/cisco adaptive security appliance software
- version/cisco adaptive security appliance software/5520
- canonical/cisco ios
- version/cisco ios/7.2\(2\)22