CVE-2010-0440 Cross-site scripting (XSS) vulnerability in +CSCOT+/translation in Cisco Secure Desktop 3.4.2048, and other versions before 3.5; as used in Cisco ASA appliance before 8.2(1), 8.1(2.7), and 8.0(5); all...
MediumCVSS 4.3
EPSS 4.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in +CSCOT+/translation in Cisco Secure Desktop 3.4.2048, and other versions before 3.5; as used in Cisco ASA appliance before 8.2(1), 8.1(2.7), and 8.0(5); allows remote attackers to inject arbitrary web script or HTML via a crafted POST parameter, which is not properly handled by an eval statement in binary/mainv.js that writes to start.html.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco secure desktop | < 3.5 | 3.5 |
| cisco adaptive security appliance software | >= 8.1, < 8.1\(2.7\) | 8.1\(2.7\) |
| cisco adaptive security appliance software | >= 8.0, < 8.0\(5\) | 8.0\(5\) |
| cisco adaptive security appliance software | >= 8.2, < 8.2\(1\) | 8.2\(1\) |
References
- 38397 third-party-advisory
- tools.cisco.com patch vendor-advisory
- www.coresecurity.com exploit third-party-advisory
- 20100201 [CORE-2010-0106] Cisco Secure Desktop XSS/JavaScript Injection mailing-list third-party-advisory vdb-entry
- 37960 exploit third-party-advisory vdb-entry
- ADV-2010-0273 third-party-advisory vdb-entry