PT-2019-2087 · Cisco · Cisco Asa+1

CVE-2019-1701 · Publicado 2019-05-01 · Atualizado 2023-08-15

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software (affected versions not specified) Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description The issue exists due to insufficient validation of user-supplied input, allowing an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the WebVPN portal of an affected device. An attacker could exploit this by persuading a user to click a crafted link, potentially executing arbitrary script code in the context of the affected interface or accessing sensitive browser-based information. The attacker would need administrator privileges on the device to exploit this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2019-01837

CVE-2019-1701

Produtos afetados

Cisco Asa

Cisco Ftd

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-1701 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asa-ftd-xss · Aviso do Fabricante
• https://t.me/cvenotify/56508 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-1701 · Aviso do Fabricante
• http://securityfocus.com/bid/108152 · Nota
• https://bdu.fstec.ru/vul/2019-01837 · Nota de Segurança