Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0, Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier, and Content Security Management Appliance (SMA) 8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, as demonstrated by the date_range parameter to monitor/reports/overview on the IronPort ESA, aka Bug IDs CSCun07998, CSCun07844, and CSCun07888.
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/127004/Cisco-Ironport-Email-Security-Virtual-Appliance-8.0.0-671-XSS.html | |
http://seclists.org/fulldisclosure/2014/Jun/57 | Exploit Third Party Advisory VDB Entry |
http://secunia.com/advisories/58296 | Permissions Required |
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3289 | Vendor Advisory |
http://tools.cisco.com/security/center/viewAlert.x?alertId=34569 | Vendor Advisory |
http://www.kb.cert.org/vuls/id/613308 | |
http://www.securityfocus.com/bid/67943 | Third Party Advisory VDB Entry |
http://www.securitytracker.com/id/1030407 | Third Party Advisory VDB Entry |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: cisco
Published: 2014-06-10T10:00:00
Updated: 2017-12-28T19:57:01
Reserved: 2014-05-07T00:00:00
Link: CVE-2014-3289
JSON object: View
NVD Information
Status : Modified
Published: 2014-06-10T11:19:35.797
Modified: 2018-10-30T16:27:22.513
Link: CVE-2014-3289
JSON object: View
Redhat Information
No data.
CWE