CVE-2018-0251: XSS
First published: Thu Apr 19 2018(Updated: )
A vulnerability in the Web Server Authentication Required screen of the Clientless Secure Sockets Layer (SSL) VPN portal of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of that portal on an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the portal or allow the attacker to access sensitive browser-based information. This vulnerability affects the following Cisco products if they are running a vulnerable release of Cisco ASA Software: 3000 Series Industrial Security Appliances, Adaptive Security Virtual Appliance (ASAv), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches, ASA Services Module for Cisco 7600 Series Routers. Cisco Bug IDs: CSCvh20742.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Adaptive Security Appliance Software | =9.8\(2.15\) | |
| Cisco Adaptive Security Appliance Software | =9.9\(1\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-0251?
CVE-2018-0251 has been classified with a high severity rating due to its potential to allow XSS attacks.
How do I fix CVE-2018-0251?
To remediate CVE-2018-0251, you should upgrade to Cisco Adaptive Security Appliance Software versions 9.8(2.16) or 9.9(1.1) or later.
Who is affected by CVE-2018-0251?
CVE-2018-0251 affects users of Cisco Adaptive Security Appliance Software versions 9.8(2.15) and 9.9(1).
What type of attack can be executed using CVE-2018-0251?
CVE-2018-0251 allows for cross-site scripting (XSS) attacks against users accessing the Clientless SSL VPN portal.
What devices are impacted by CVE-2018-0251?
Devices running Cisco Adaptive Security Appliance Software that meet the affected version criteria are impacted by CVE-2018-0251.
- agent/author
- agent/type
- agent/softwarecombine
- agent/references
- agent/severity
- agent/weakness
- agent/first-publish-date
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- vendor/cisco
- canonical/cisco adaptive security appliance software
- version/cisco adaptive security appliance software/9.8\(2.15\)
- version/cisco adaptive security appliance software/9.9\(1\)