CVE-2010-0440: XSS
Cross-site scripting (XSS) vulnerability in +CSCOT+/translation in Cisco Secure Desktop 3.4.2048, and other versions before 3.5; as used in Cisco ASA appliance before 8.2(1), 8.1(2.7), and 8.0(5); allows remote attackers to inject arbitrary web script or HTML via a crafted POST parameter, which is not properly handled by an eval statement in binary/mainv.js that writes to start.html.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0440?
CVE-2010-0440 is classified as a medium severity vulnerability due to its potential to allow remote attackers to inject arbitrary web scripts.
How do I fix CVE-2010-0440?
To mitigate CVE-2010-0440, upgrade Cisco Secure Desktop to version 3.5 or later and ensure your Cisco Adaptive Security Appliance Software is updated to secure versions beyond the specified vulnerable ones.
What types of attacks can exploit CVE-2010-0440?
CVE-2010-0440 can be exploited through cross-site scripting (XSS) attacks that leverage crafted POST parameters.
Which Cisco products are affected by CVE-2010-0440?
CVE-2010-0440 affects Cisco Secure Desktop versions prior to 3.5 and several versions of Cisco Adaptive Security Appliance Software.
Is CVE-2010-0440 a local or remote vulnerability?
CVE-2010-0440 is a remote vulnerability, allowing attackers to exploit it without direct access to the affected systems.