CVE-2014-3289

2014-06-1011:19:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2014-3289

cross-site scripting

xss

cisco asyncos

email security appliance

esa 8.0

web security appliance

wsa 8.0

content security management appliance

sma 8.3

ironport esa

nvd

5.7 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

69.4%

JSON

Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0, Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier, and Content Security Management Appliance (SMA) 8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, as demonstrated by the date_range parameter to monitor/reports/overview on the IronPort ESA, aka Bug IDs CSCun07998, CSCun07844, and CSCun07888.

CPENameOperatorVersion
cisco:ironport_asyncoscisco ironport asyncosle8.0
cisco:web_security_appliancecisco web security applianceeq-
cisco:ironport_asyncoscisco ironport asyncosle8.3
cisco:content_security_management_appliancecisco content security management applianceeq-
cisco:email_security_appliance_firmwarecisco email security appliance firmwareeq-

CPE	Name	Operator	Version
cisco:ironport_asyncos	cisco ironport asyncos	le	8.0
cisco:web_security_appliance	cisco web security appliance	eq	-
cisco:ironport_asyncos	cisco ironport asyncos	le	8.3
cisco:content_security_management_appliance	cisco content security management appliance	eq	-
cisco:email_security_appliance_firmware	cisco email security appliance firmware	eq	-