CVE-2009-1202

Cisco Adaptive Security Appliance - Cross-Site Scripting via Modified Hex-Encoded URI

Title source: llm
STIX 2.1

Description

WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass certain protection mechanisms involving URL rewriting and HTML rewriting, and conduct cross-site scripting (XSS) attacks, by modifying the first hex-encoded character in a /+CSCO+ URI, aka Bug ID CSCsy80705.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/504516/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1022457
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/35480
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/1713
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/35511

Scores

EPSS 0.0198
EPSS Percentile 78.5%

Details

CWE
CWE-79
Status published
Products (4)
cisco/adaptive_security_appliance 8.0\(4\)
cisco/adaptive_security_appliance 8.1.2
cisco/adaptive_security_appliance 8.2.1
cisco/adaptive_security_appliance
Published Jun 25, 2009
Tracked Since Feb 18, 2026