{"schemaVersion":3,"id":"CVE-2014-3289","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0, Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier, and Content Security Management Appliance (SMA) 8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, as demonstrated by the date_range parameter to monitor/reports/overview on the IronPort ESA, aka Bug IDs CSCun07998, CSCun07844, and CSCun07888.","dates":{"published":"2014-06-10T10:00:00.000Z","modified":"2024-08-06T10:35:57.192Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.3,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.3,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02426,"percentile":0.84068,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.02426},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.02426,"percentile":0.84068}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.02426,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.02426,"percentile":0.84068}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_A4C3BA7416D11C4C","name":"Exploit Reference (seclists.org)","source":"reference","url":"http://seclists.org/fulldisclosure/2014/Jun/57","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"cisco","product":"content_security_management_appliance","name":"content security management appliance","label":"content_security_management_appliance","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/content_security_management_appliance"},{"vendor":"cisco","product":"email_security_appliance_firmware","name":"email security appliance firmware","label":"email_security_appliance_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/email_security_appliance"},{"vendor":"cisco","product":"ironport_asyncos","name":"ironport asyncos","label":"ironport_asyncos","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 8.0","noFixRecorded":false,"fixedIn":null},{"text":"≤ 8.3","noFixRecorded":false,"fixedIn":null},{"text":"8.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 8.0 | ≤ 8.3 | 8.0","eol":null,"hubHref":"/vendor/cisco/ironport_asyncos"},{"vendor":"cisco","product":"web_security_appliance","name":"web security appliance","label":"web_security_appliance","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/web_security_appliance"}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securitytracker.com/id/1030407","label":"www.securitytracker.com/id/1030407","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Third Party Advisory"]},{"url":"http://www.kb.cert.org/vuls/id/613308","label":"www.kb.cert.org/vuls/id/613308","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN"]},{"url":"http://packetstormsecurity.com/files/127004/Cisco-Ironport-Email-Security-Virtual-Appliance-8.0.0-671-XSS.html","label":"packetstormsecurity.com/files/…","hostname":"packetstormsecurity.com","tags":["X Refsource MISC"]},{"url":"http://seclists.org/fulldisclosure/2014/Jun/57","label":"seclists.org/fulldisclosure/2014/Jun/57","hostname":"seclists.org","tags":["Mailing List","X Refsource FULLDISC","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=34569","label":"tools.cisco.com/security/center/viewAlert.x?alertId=34569","hostname":"tools.cisco.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://secunia.com/advisories/58296","label":"secunia.com/advisories/58296","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Permissions Required"]},{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3289","label":"tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3289","hostname":"tools.cisco.com","tags":["Vendor Advisory","X Refsource CISCO"]},{"url":"http://www.securityfocus.com/bid/67943","label":"www.securityfocus.com/bid/67943","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2014-06-10T10:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-06T10:35:57.192Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":28,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T15:33:09.297Z","stale":false,"partial":false}}