CVE-2008-3821

Cisco IOS <12.4 - XSS

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in the HTTP server in Cisco IOS 11.0 through 12.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the ping program or (2) unspecified other aspects of the URI.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Adrian Pastor · textremotehardware

https://www.exploit-db.com/exploits/32723

View Code ZIP pw:eip

References (12)

[Third Party Advisory, VDB Entry] http://jvn.jp/en/jp/JVN28344798/index.html

[Broken Link] http://osvdb.org/51393

[Broken Link] http://osvdb.org/51394

[Third Party Advisory] http://secunia.com/advisories/33461

[Third Party Advisory] http://securityreason.com/securityalert/4916

[Third Party Advisory, VDB Entry] http://securitytracker.com/id?1021598

[Vendor Advisory] http://www.cisco.com/en/US/products/products_security_response09186a0080a5c501.html

[Exploit] http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-19

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/33260

[Not Applicable] http://www.vupen.com/english/advisories/2009/0138

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/47947

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/500063/100/0/threaded

Scores

EPSS 0.0893

EPSS Percentile 92.5%

Classification

CWE

CWE-79

Status published

Affected Products (50)

cisco/ios

cisco/ios

cisco/ios

cisco/ios

cisco/ios

cisco/ios

cisco/ios

cisco/ios

cisco/ios

cisco/ios

cisco/ios

cisco/ios

cisco/ios

cisco/ios

cisco/ios

... and 35 more

Timeline

Published Jan 16, 2009

Tracked Since Feb 18, 2026