medium4.3Public exploit code
CVE-2009-1201
Eval injection vulnerability in the csco_wrap_js function in /+CSCOL+/cte.js in WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Cisco ASA Appliance 8.x - WebVPN DOM Wrapper Cross-Site Scripting2009-05-24 · remote · hardware · Verified
Impact
Eval injection vulnerability in the csco_wrap_js function in /+CSCOL+/cte.js in WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass a DOM wrapper and conduct cross-site scripting (XSS) attacks by setting CSCO_WebVPN['process'] to the name of a crafted function, aka Bug ID CSCsy80694.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cisco | Adaptive Security Appliance | All versions Versions 8.0\(4\), 8.1.2, 8.2.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/35511
- http://www.securityfocus.com/archive/1/504516/100/0/threaded
- http://www.securityfocus.com/bid/35476
- http://www.securitytracker.com/id?1022457
- http://www.vupen.com/english/advisories/2009/1713
- https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt
- http://secunia.com/advisories/35511
- http://www.securityfocus.com/archive/1/504516/100/0/threaded
- http://www.securityfocus.com/bid/35476
- http://www.securitytracker.com/id?1022457
- http://www.vupen.com/english/advisories/2009/1713
- https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt