CVE-2014-3289: XSS
Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0, Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier, and Content Security Management Appliance (SMA) 8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, as demonstrated by the daterange parameter to monitor/reports/overview on the IronPort ESA, aka Bug IDs CSCun07998, CSCun07844, and CSCun07888.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3289?
CVE-2014-3289 is classified as a medium severity vulnerability due to its potential for remote exploitation via cross-site scripting.
How do I fix CVE-2014-3289?
To fix CVE-2014-3289, update to the latest version of Cisco AsyncOS that addresses this XSS vulnerability.
What products are affected by CVE-2014-3289?
CVE-2014-3289 affects Cisco AsyncOS on Email Security Appliance, Web Security Appliance, and Content Security Management Appliance versions prior to the specified updates.
Can CVE-2014-3289 be exploited remotely?
Yes, CVE-2014-3289 can be exploited remotely by attackers injecting malicious scripts through the web management interface.
What type of vulnerability is CVE-2014-3289?
CVE-2014-3289 is a cross-site scripting (XSS) vulnerability that allows for the injection of arbitrary web scripts.