CVE-2014-3289: XSS
First published: Tue Jun 10 2014(Updated: )
Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0, Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier, and Content Security Management Appliance (SMA) 8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, as demonstrated by the date_range parameter to monitor/reports/overview on the IronPort ESA, aka Bug IDs CSCun07998, CSCun07844, and CSCun07888.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IronPort AsyncOS | <=8.0 | |
| Cisco Web Security Appliance | ||
| Cisco IronPort AsyncOS | <=8.3 | |
| Cisco Content Security Management Appliance | ||
| Cisco IronPort AsyncOS | =8.0 | |
| Cisco Email Security Appliance Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/127004/Cisco-Ironport-Email-Security-Virtual-Appliance-8.0.0-671-XSS.html
- http://seclists.org/fulldisclosure/2014/Jun/57
- http://secunia.com/advisories/58296
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3289
- http://tools.cisco.com/security/center/viewAlert.x?alertId=34569
- http://www.kb.cert.org/vuls/id/613308
- http://www.securityfocus.com/bid/67943
- http://www.securitytracker.com/id/1030407
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/type
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/cisco
- canonical/cisco ironport asyncos
- version/cisco ironport asyncos/8.0
- canonical/cisco web security appliance
- version/cisco ironport asyncos/8.3
- canonical/cisco content security management appliance
- canonical/cisco email security appliance firmware