CVE-2009-1220
5.9 Medium
AI Score
Confidence
High
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.012 Low
EPSS
Percentile
85.3%
Cross-site scripting (XSS) vulnerability in +webvpn+/index.html in WebVPN on the Cisco Adaptive Security Appliances (ASA) 5520 with software 7.2(4)30 and earlier 7.2 versions including 7.2(2)22, and 8.0(4)28 and earlier 8.0 versions, when clientless mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the Host HTTP header.
| CPE | Name | Operator | Version |
|---|---|---|---|
| cisco:ios | cisco ios | eq | 7.2\(2\)22 |
| cisco:adaptive_security_appliance | cisco adaptive security appliance | eq | 5520 |
References
archives.neohapsis.com/archives/fulldisclosure/2009-03/0478.html
tools.cisco.com/security/center/viewAlert.x?alertId=17950
www.securityfocus.com/archive/1/502313/100/0/threaded
www.securityfocus.com/archive/1/502932
www.securityfocus.com/bid/34307
www.securitytracker.com/id?1022122
www.vupen.com/english/advisories/2009/1169
exchange.xforce.ibmcloud.com/vulnerabilities/49528
Related
5.9 Medium
AI Score
Confidence
High
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.012 Low
EPSS
Percentile
85.3%