CVE-2014-3289 | BDVDB-2026-62059 Detail
Description#
Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0, Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier, and Content Security Management Appliance (SMA) 8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, as demonstrated by the date_range parameter to monitor/reports/overview on the IronPort ESA, aka Bug IDs CSCun07998, CSCun07844, and CSCun07888.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://www.securitytracker.com/id/1030407
- http://www.kb.cert.org/vuls/id/613308
- http://packetstormsecurity.com/files/127004/Cisco-Ironport-Email-Security-Virtual-Appliance-8.0.0-671-XSS.html
- http://seclists.org/fulldisclosure/2014/Jun/57
- http://tools.cisco.com/security/center/viewAlert.x?alertId=34569
- http://secunia.com/advisories/58296
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3289
- http://www.securityfocus.com/bid/67943
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.