CVE-2009-1220

Cisco Adaptive Security Appliance - XSS

Title source: rule
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in +webvpn+/index.html in WebVPN on the Cisco Adaptive Security Appliances (ASA) 5520 with software 7.2(4)30 and earlier 7.2 versions including 7.2(2)22, and 8.0(4)28 and earlier 8.0 versions, when clientless mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the Host HTTP header.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Bugs NotHugs · textremotehardware
https://www.exploit-db.com/exploits/32878

References (8)

Core 8
Core References
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/502932
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/34307
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1022122
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/1169
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/49528
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/502313/100/0/threaded
Third Party Advisory mailing-list x_refsource_fulldisc
http://archives.neohapsis.com/archives/fulldisclosure/2009-03/0478.html

Scores

EPSS 0.1865
EPSS Percentile 95.3%

Details

CWE
CWE-79
Status published
Products (2)
cisco/adaptive_security_appliance 5520
cisco/ios 7.2\(2\)22
Published Apr 01, 2009
Tracked Since Feb 18, 2026