PT-2014-2059 · Cisco · Cisco Asa

CVE-2014-2120 · Publicado 2014-03-18 · Atualizado 2024-12-19

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software (affected versions not specified)

Description The issue is a cross-site scripting (XSS) vulnerability in the WebVPN login page of Cisco Adaptive Security Appliance (ASA) Software. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter. The vulnerability exists due to the lack of protection of the web page structure, which can be exploited by a remote attacker to conduct an XSS attack. There is evidence of active exploitation of this vulnerability, with attackers using it to execute XSS attacks remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2025-00123

CVE-2014-2120

Produtos afetados

Cisco Asa

Referências · 19

• https://twitter.com/rst_cloud/status/1864611643457503633 · Publicação no Twitter
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2120 · Aviso do Fabricante
• https://twitter.com/the_yellow_fall/status/1856530384827363776 · Publicação no Twitter
• http://securityfocus.com/bid/66290 · Nota
• https://t.me/thehackernews/5979 · Publicação no Telegram
• https://t.me/cvenotify/104981 · Publicação no Telegram
• https://t.me/cvenotify/101462 · Publicação no Telegram
• https://t.me/cvenotify/101765 · Publicação no Telegram
• https://t.me/pentestingnews/53881 · Publicação no Telegram
• https://t.me/aptreports/14533 · Publicação no Telegram
• https://t.me/cvenotify/101531 · Publicação no Telegram
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CVE-2014-2120 · Aviso do Fabricante
• http://securitytracker.com/id/1029935 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2120 · Nota de Segurança