PT-2015-4847 · Cisco · Cisco Asyncos+3

Published 2015-07-29 · Updated 2018-10-30 · CVE-2015-0732

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco AsyncOS on the Web Security Appliance (WSA) version 9.0.0-193 Cisco Email Security Appliance (ESA) versions 8.5.6-113, 9.1.0-032, 9.1.1-000, and 9.6.0-000 Cisco Content Security Management Appliance (SMA) version 9.1.0-033

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter. This could potentially lead to unauthorized actions on the affected system.

Recommendations For Cisco AsyncOS on the Web Security Appliance (WSA) version 9.0.0-193, update to a fixed version to resolve the issue. For Cisco Email Security Appliance (ESA) versions 8.5.6-113, 9.1.0-032, 9.1.1-000, and 9.6.0-000, update to a fixed version to resolve the issue. For Cisco Content Security Management Appliance (SMA) version 9.1.0-033, update to a fixed version to resolve the issue. As a temporary workaround, consider restricting access to unspecified parameters to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-0732

Affected Products

Cisco Asyncos

Cisco Content Security Management Appliance

Cisco Email Security Appliance

Web Security Appliance

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-0732 · Security Note
• http://tools.cisco.com/security/center/viewAlert.x?alertId=40172 · Vendor Advisory
• http://securitytracker.com/id/1033087 · Note
• http://securitytracker.com/id/1033086 · Note