Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2014-3289

Опубликовано: 10 июн. 2014
Источник: nvd
CVSS2: 4.3
EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0, Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier, and Content Security Management Appliance (SMA) 8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, as demonstrated by the date_range parameter to monitor/reports/overview on the IronPort ESA, aka Bug IDs CSCun07998, CSCun07844, and CSCun07888.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:cisco:ironport_asyncos:*:*:*:*:*:*:*:*
Версия до 8.0 (включая)
cpe:2.3:h:cisco:web_security_appliance:-:*:*:*:*:*:*:*
Конфигурация 2

Одновременно

cpe:2.3:o:cisco:ironport_asyncos:*:*:*:*:*:*:*:*
Версия до 8.3 (включая)
cpe:2.3:h:cisco:content_security_management_appliance:-:*:*:*:*:*:*:*
Конфигурация 3

Одновременно

cpe:2.3:o:cisco:ironport_asyncos:8.0:*:*:*:*:*:*:*
cpe:2.3:o:cisco:email_security_appliance_firmware:-:*:*:*:*:*:*:*

EPSS

Процентиль: 71%
0.0066
Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

github логотип

GHSA-wm7r-m669-55pm

github
больше 3 лет назад

Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0, Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier, and Content Security Management Appliance (SMA) 8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, as demonstrated by the date_range parameter to monitor/reports/overview on the IronPort ESA, aka Bug IDs CSCun07998, CSCun07844, and CSCun07888.

EPSS

Процентиль: 71%
0.0066
Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79