CVE-2016-6436: XSS
Published Oct 6, 2016
·Updated
Cross-site scripting (XSS) vulnerability in HostScan Engine 3.0.08062 through 3.1.14018 in the Cisco Host Scan package, as used in ASA Web VPN, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuz14682.
Affected Software
22 affected components
Cisco HostScan Engine=3.0.08062
Cisco HostScan Engine=3.0.08066
Cisco HostScan Engine=3.1.01065
Cisco HostScan Engine=3.1.02016
Cisco HostScan Engine=3.1.02026
Cisco HostScan Engine=3.1.02040
Cisco HostScan Engine=3.1.02043
Cisco HostScan Engine=3.1.03103
Cisco HostScan Engine=3.1.03104
Cisco HostScan Engine=3.1.04060
Cisco HostScan Engine=3.1.04063
Cisco HostScan Engine=3.1.04075
Cisco HostScan Engine=3.1.04082
Cisco HostScan Engine=3.1.05152
Cisco HostScan Engine=3.1.05160
Cisco HostScan Engine=3.1.05163
Cisco HostScan Engine=3.1.05170
Cisco HostScan Engine=3.1.05178
Cisco HostScan Engine=3.1.05182
Cisco HostScan Engine=3.1.05183
Cisco HostScan Engine=3.1.06073
Cisco HostScan Engine=3.1.14018
Event History
Oct 6, 2016
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-6436?
The severity of CVE-2016-6436 is classified as medium due to its potential exploitation via cross-site scripting.
2
How do I fix CVE-2016-6436?
To fix CVE-2016-6436, upgrade the Cisco HostScan Engine to the latest version that addresses this vulnerability.
3
What versions of Cisco HostScan Engine are affected by CVE-2016-6436?
CVE-2016-6436 affects Cisco HostScan Engine versions from 3.0.08062 to 3.1.14018.
4
Can CVE-2016-6436 be exploited remotely?
Yes, CVE-2016-6436 can be exploited remotely by attackers through a crafted URL.
5
What type of vulnerability is CVE-2016-6436?
CVE-2016-6436 is a cross-site scripting (XSS) vulnerability that allows injection of arbitrary web scripts.