CVE-2006-3073

Cisco ASA 5500 and VPN 3000 Series - Cross-Site Scripting via WebVPN Domain Parameter

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in the WebVPN feature in the Cisco VPN 3000 Series Concentrators and Cisco ASA 5500 Series Adaptive Security Appliances (ASA), when in WebVPN clientless mode, allow remote attackers to inject arbitrary web script or HTML via the domain parameter in (1) dnserror.html and (2) connecterror.html, aka bugid CSCsd81095 (VPN3k) and CSCse48193 (ASA). NOTE: the vendor states that "WebVPN full-network-access mode" is not affected, despite the claims by the original researcher.

References (9)

Core 9

Core References

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/436479/30/0/threaded

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/20644

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://www.osvdb.org/26454

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://www.osvdb.org/26453

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2006/2331

Exploit vdb-entry x_refsource_sectrack

http://securitytracker.com/id?1016252

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/18419

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/27086

Vendor Advisory vendor-advisory x_refsource_cisco

http://www.cisco.com/warp/public/707/cisco-sr-20060613-webvpn-xss.shtml

Scores

EPSS 0.0173

EPSS Percentile 75.3%

Details

Status published

Products (38)

cisco/asa_5500 7.0

cisco/asa_5500 7.0\(4\)

cisco/asa_5500 7.0.4.3

cisco/vpn_3000_concentrator_series_software 2.0

cisco/vpn_3000_concentrator_series_software 2.5.2.a

cisco/vpn_3000_concentrator_series_software 2.5.2.b

cisco/vpn_3000_concentrator_series_software 2.5.2.c

cisco/vpn_3000_concentrator_series_software 2.5.2.d

cisco/vpn_3000_concentrator_series_software 2.5.2.f

cisco/vpn_3000_concentrator_series_software 3.0

... and 28 more

Published Jun 19, 2006

Tracked Since Feb 18, 2026