Lucene search

CiscoCVE-2015-0732

HistoryJul 29, 2015 - 1:59 a.m.

CVE-2015-0732

2015-07-2901:59:00

CWE-79

cisco

web.nvd.nist.gov

cisco

asyncos

xss

vulnerability

wsa

esa

sma

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.9

Confidence

High

EPSS

0.002

Percentile

56.9%

JSON

Cross-site scripting (XSS) vulnerability in Cisco AsyncOS on the Web Security Appliance (WSA) 9.0.0-193; Email Security Appliance (ESA) 8.5.6-113, 9.1.0-032, 9.1.1-000, and 9.6.0-000; and Content Security Management Appliance (SMA) 9.1.0-033 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug IDs CSCuu37430, CSCuu37420, CSCut71981, and CSCuv50167.

Affected configurations

Nvd

Node

ciscoweb_security_applianceMatch9.0.0-193

Node

ciscocontent_security_management_virtual_applianceMatch9.1.0-033

Node

ciscoemail_security_appliance_firmwareMatch8.5.6-113

ciscoemail_security_appliance_firmwareMatch9.1.0-032

ciscoemail_security_appliance_firmwareMatch9.1.1-000

ciscoemail_security_appliance_firmwareMatch9.6.0-000

VendorProductVersionCPE
ciscoweb_security_appliance9.0.0-193cpe:2.3:a:cisco:web_security_appliance:9.0.0-193:*:*:*:*:*:*:*
ciscocontent_security_management_virtual_appliance9.1.0-033cpe:2.3:a:cisco:content_security_management_virtual_appliance:9.1.0-033:*:*:*:*:*:*:*
ciscoemail_security_appliance_firmware8.5.6-113cpe:2.3:o:cisco:email_security_appliance_firmware:8.5.6-113:*:*:*:*:*:*:*
ciscoemail_security_appliance_firmware9.1.0-032cpe:2.3:o:cisco:email_security_appliance_firmware:9.1.0-032:*:*:*:*:*:*:*
ciscoemail_security_appliance_firmware9.1.1-000cpe:2.3:o:cisco:email_security_appliance_firmware:9.1.1-000:*:*:*:*:*:*:*
ciscoemail_security_appliance_firmware9.6.0-000cpe:2.3:o:cisco:email_security_appliance_firmware:9.6.0-000:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	web_security_appliance	9.0.0-193	cpe:2.3:a:cisco:web_security_appliance:9.0.0-193:::::::*
cisco	content_security_management_virtual_appliance	9.1.0-033	cpe:2.3:a:cisco:content_security_management_virtual_appliance:9.1.0-033:::::::*
cisco	email_security_appliance_firmware	8.5.6-113	cpe:2.3:o:cisco:email_security_appliance_firmware:8.5.6-113:::::::*
cisco	email_security_appliance_firmware	9.1.0-032	cpe:2.3:o:cisco:email_security_appliance_firmware:9.1.0-032:::::::*
cisco	email_security_appliance_firmware	9.1.1-000	cpe:2.3:o:cisco:email_security_appliance_firmware:9.1.1-000:::::::*
cisco	email_security_appliance_firmware	9.6.0-000	cpe:2.3:o:cisco:email_security_appliance_firmware:9.6.0-000:::::::*

References

tools.cisco.com/security/center/viewAlert.x?alertId=40172

www.securitytracker.com/id/1033086

www.securitytracker.com/id/1033087

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.9

Confidence

High

EPSS

0.002

Percentile

56.9%

JSON

Related for CVE-2015-0732