CVE-2014-2120mediumunder attackCWE-79

CVE-2014-2120

Published · Updated

Follow this CVE+ Monitor Cisco Adaptive Security Appliance

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 5.4epss 23%
from disclosure to weapon
Published on NVDMar 19
CISA KEV+3891d
Action required by CISAfederal deadline: 2024-12-03

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A vulnerability in Cisco ASA's WebVPN login page allows attackers to inject malicious scripts or HTML code. This could let attackers steal login credentials or redirect users to fake pages.

Technical detail

Reflected XSS vulnerability in Cisco ASA WebVPN login interface via unsanitized parameter input. Remote, unauthenticated attacker can inject arbitrary JavaScript/HTML; exploitation requires user interaction (clicking malicious link). Impact includes credential theft and session hijacking.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
n/a · n/a