CVE-2014-3289

Cisco IronPort AsyncOS < 8.0 - Cross-Site Scripting via date_range Parameter

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0, Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier, and Content Security Management Appliance (SMA) 8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, as demonstrated by the date_range parameter to monitor/reports/overview on the IronPort ESA, aka Bug IDs CSCun07998, CSCun07844, and CSCun07888.

References (8)

Core 8

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1030407

Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn

http://www.kb.cert.org/vuls/id/613308

Exploit, Third Party Advisory x_refsource_misc

http://packetstormsecurity.com/files/127004/Cisco-Ironport-Email-Security-Virtual-Appliance-8.0.0-671-XSS.html

Exploit, Third Party Advisory, VDB Entry mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2014/Jun/57

Vendor Advisory x_refsource_confirm

http://tools.cisco.com/security/center/viewAlert.x?alertId=34569

Permissions Required third-party-advisory x_refsource_secunia

http://secunia.com/advisories/58296

Vendor Advisory vendor-advisory x_refsource_cisco

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3289

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/67943

Scores

EPSS 0.0243

EPSS Percentile 82.5%

Details

CWE

CWE-79

Status published

Products (5)

cisco/content_security_management_appliance

cisco/email_security_appliance_firmware

cisco/ironport_asyncos 8.0

cisco/ironport_asyncos < 8.0

cisco/web_security_appliance

Published Jun 10, 2014

Tracked Since Feb 18, 2026