PT-2019-2087 · Cisco · Cisco Asa+1

Published 2019-05-01 · Updated 2023-08-15 · CVE-2019-1701

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software (affected versions not specified) Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description The issue exists due to insufficient validation of user-supplied input, allowing an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the WebVPN portal of an affected device. An attacker could exploit this by persuading a user to click a crafted link, potentially executing arbitrary script code in the context of the affected interface or accessing sensitive browser-based information. The attacker would need administrator privileges on the device to exploit this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2019-01837

CVE-2019-1701

Affected Products

Cisco Asa

Cisco Ftd

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-1701 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asa-ftd-xss · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1701 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01837 · Security Note
• https://t.me/cvenotify/56508 · Telegram Post
• http://securityfocus.com/bid/108152 · Note