Description
Eval injection vulnerability in the csco_wrap_js function in /+CSCOL+/cte.js in WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass a DOM wrapper and conduct cross-site scripting (XSS) attacks by setting CSCO_WebVPN['process'] to the name of a crafted function, aka Bug ID CSCsy80694.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Trustwave's SpiderLabs · htmlremotehardware
https://www.exploit-db.com/exploits/33055
References (6)
Core 6
Core References
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/35476
Various Sources x_refsource_misc
https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/504516/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1022457
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2009/1713
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/35511
Scores
EPSS
0.0486
EPSS Percentile
89.6%
Details
CWE
CWE-79
Status
published
Products (4)
cisco/adaptive_security_appliance
8.0\(4\)
cisco/adaptive_security_appliance
8.1.2
cisco/adaptive_security_appliance
8.2.1
cisco/adaptive_security_appliance
Published
Jun 25, 2009
Tracked Since
Feb 18, 2026