CVE-2014-8021

Published: Feb 3, 2015Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in Cisco AnyConnect Secure Mobility Client 3.1(.02043) and earlier and Cisco HostScan Engine 3.1(.05183) and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving an applet-path URL, aka Bug IDs CSCup82990 and CSCuq80149.

Affected (2)

Products: Cisco: Hostscan Engine, Anyconnect Secure Mobility Client

2 products

Hostscan Engine

Anyconnect Secure Mobility Client

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cisco Hostscan Engine	Up to 3.1\(.05183\)

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Cisco Anyconnect Secure Mobility Client	Up to 3.1\(.02043\)

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (8)

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8021

Source: psirt@cisco.com

Vendor Advisory

http://tools.cisco.com/security/center/viewAlert.x?alertId=37323

Source: psirt@cisco.com

Vendor Advisory

http://www.securityfocus.com/bid/72475

Source: psirt@cisco.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/100666

Source: psirt@cisco.com

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8021

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://tools.cisco.com/security/center/viewAlert.x?alertId=37323

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/bid/72475

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/100666

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.