CVE-2009-1202

Published: Jun 25, 2009Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass certain protection mechanisms involving URL rewriting and HTML rewriting, and conduct cross-site scripting (XSS) attacks, by modifying the first hex-encoded character in a /+CSCO+ URI, aka Bug ID CSCsy80705.

Affected (4)

Products: Cisco: Adaptive Security Appliance

1 product

Adaptive Security Appliance

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Cisco Adaptive Security Appliance	Version 8.0(4)
Cisco Adaptive Security Appliance	Version 8.1.2
Cisco Adaptive Security Appliance	Version 8.2.1
Cisco Adaptive Security Appliance	All versions

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (10)

http://secunia.com/advisories/35511

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/504516/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/35480

Source: cve@mitre.org

http://www.securitytracker.com/id?1022457

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/1713

Source: cve@mitre.org

http://secunia.com/advisories/35511

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/504516/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/35480

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1022457

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2009/1713

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.