CVE-2014-3289: cisco content_security_management_appliance Cross-site Scripting

Vulnerability summary

CVE-2014-3289 is a medium (CVSS 4.3) Cross-site Scripting vulnerability in cisco content_security_management_appliance. EPSS estimates a 2.43% chance of exploitation in the next 30 days, higher than 84% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 10-06-2014
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0, Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier, and Content Security Management Appliance (SMA) 8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, as demonstrated by the date_range parameter to monitor/reports/overview on the IronPort ESA, aka Bug IDs CSCun07998, CSCun07844, and CSCun07888.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.