Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2018-0242

Опубликовано: 19 апр. 2018
Источник: nvd
CVSS3: 6.1
CVSS2: 4.3
EPSS Низкий

Описание

A vulnerability in the WebVPN web-based management interface of Cisco Adaptive Security Appliance could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvg33985.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:cisco:adaptive_security_appliance_software:9.1\(7.245\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:9.6\(3\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8\(1\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8\(2\):*:*:*:*:*:*:*

Одно из

cpe:2.3:h:cisco:asa_5506-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asa_5506h-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asa_5506w-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asa_5508-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asa_5512-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asa_5515-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asa_5516-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asa_5525-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asa_5545-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asa_5585-x:-:*:*:*:*:*:*:*

EPSS

Процентиль: 56%
0.00332
Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79
CWE-79

Связанные уязвимости

github логотип

GHSA-59h4-8cfv-5wcg

CVSS3: 6.1
github
больше 3 лет назад

A vulnerability in the WebVPN web-based management interface of Cisco Adaptive Security Appliance could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvg33985.

fstec логотип

BDU:2023-04880

CVSS3: 6.1
fstec
почти 8 лет назад

Уязвимость веб-интерфейса управления WebVPN микропрограммного обеспечения межсетевых экранов Cisco Adaptive Security Appliance (ASA), позволяющая нарушителю провести атаку межсайтового скриптинга (XSS)

EPSS

Процентиль: 56%
0.00332
Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79
CWE-79