Vulnerability Details CVE-2009-1201
Eval injection vulnerability in the csco_wrap_js function in /+CSCOL+/cte.js in WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass a DOM wrapper and conduct cross-site scripting (XSS) attacks by setting CSCO_WebVPN['process'] to the name of a crafted function, aka Bug ID CSCsy80694.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.129
EPSS Ranking 93.6%
CVSS Severity
CVSS v2 Score 4.3
References
- http://secunia.com/advisories/35511
- http://www.securityfocus.com/archive/1/504516/100/0/threaded
- http://www.securityfocus.com/bid/35476
- http://www.securitytracker.com/id?1022457
- http://www.vupen.com/english/advisories/2009/1713
- https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt
- http://secunia.com/advisories/35511
- http://www.securityfocus.com/archive/1/504516/100/0/threaded
- http://www.securityfocus.com/bid/35476
- http://www.securitytracker.com/id?1022457
- http://www.vupen.com/english/advisories/2009/1713
- https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt
Products affected by CVE-2009-1201
-
cpe:2.3:a:cisco:adaptive_security_appliance:8.0(4)
-
cpe:2.3:a:cisco:adaptive_security_appliance:8.1.2
-
cpe:2.3:a:cisco:adaptive_security_appliance:8.2.1
-
cpe:2.3:h:cisco:adaptive_security_appliance:-
-
cpe:2.3:h:cisco:adaptive_security_appliance:7.0(0)
-
cpe:2.3:h:cisco:adaptive_security_appliance:7.0(2)
-
cpe:2.3:h:cisco:adaptive_security_appliance:7.0(4)
-
cpe:2.3:h:cisco:adaptive_security_appliance:7.1
-
cpe:2.3:h:cisco:adaptive_security_appliance:7.2
-
cpe:2.3:h:cisco:adaptive_security_appliance:8.0