CVE-2014-2120 Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified....
MediumCVSS 6.1
EPSS 22.6%
CISA KEV
added 2024-11-12 · due 2024-12-03
Exploited in the wild
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.
CISA Known Exploited Vulnerability
- Date added
- 2024-11-12
- Due date (FCEB)
- 2024-12-03
- Ransomware use
- Unknown
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco adaptive security appliance software | All versions | No fix listed |
References
- 20140318 Cisco Adaptive Security Appliance WebVPN Login Page Cross-Site Scripting Vulnerability broken-link vendor-advisory
- 66290 broken-link third-party-advisory vdb-entry
- 1029935 broken-link third-party-advisory vdb-entry
- www.cisa.gov government-resource us-government-resource