CVE-2008-0533 Multiple cross-site scripting (XSS) vulnerabilities in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution...
MediumCVSS 4.3
EPSS 28.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution Engine allow remote attackers to inject arbitrary web script or HTML via an argument located immediately after the Help argument, and possibly unspecified other vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco acs for windows | All versions | No fix listed |
| cisco acs solution engine | All versions | No fix listed |
| cisco user changeable password | = 4.1 | No fix listed |
References
- 29351 patch third-party-advisory vendor-advisory
- 3743 third-party-advisory
- 1019607 vdb-entry
- 20080312 Cisco Secure Access Control Server for Windows User-Changeable Password Vulnerabilities patch vendor-advisory
- www.recurity-labs.com
- 20080312 Cisco ACS UCP Remote Pre-Authentication Buffer Overflows mailing-list
- 28222 exploit vdb-entry
- ADV-2008-0868 vdb-entry
- cisco-acs-ucp-csusercgi-xss(41156) vdb-entry