CVE-2014-8021

Cross-site scripting (XSS) vulnerability in Cisco AnyConnect Secure Mobility Client 3.1(.02043) and earlier and Cisco HostScan Engine 3.1(.05183) and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving an applet-path URL, aka Bug IDs CSCup82990 and CSCuq80149.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8021	Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=37323	Vendor Advisory
http://www.securityfocus.com/bid/72475
https://exchange.xforce.ibmcloud.com/vulnerabilities/100666
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8021	Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=37323	Vendor Advisory
http://www.securityfocus.com/bid/72475
https://exchange.xforce.ibmcloud.com/vulnerabilities/100666

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:hostscan_engine:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*

History

21 Nov 2024, 02:18

Type	Values Removed	Values Added
References	~~() http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8021 - Vendor Advisory~~	() http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8021 - Vendor Advisory
References	~~() http://tools.cisco.com/security/center/viewAlert.x?alertId=37323 - Vendor Advisory~~	() http://tools.cisco.com/security/center/viewAlert.x?alertId=37323 - Vendor Advisory
References	~~() http://www.securityfocus.com/bid/72475 -~~	() http://www.securityfocus.com/bid/72475 -
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/100666 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/100666 -

Information

Published : 2015-02-03 22:59

Updated : 2024-11-21 02:18

NVD link : CVE-2014-8021

Mitre link : CVE-2014-8021

CVE.ORG link : CVE-2014-8021

JSON object : View

Products Affected

cisco

hostscan_engine
anyconnect_secure_mobility_client

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2014-8021", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2015-02-03T22:59:01.253", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8021", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=37323", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/72475", "source": "ykramarz@cisco.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/100666", "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8021", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=37323", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/72475", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/100666", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in Cisco AnyConnect Secure Mobility Client 3.1(.02043) and earlier and Cisco HostScan Engine 3.1(.05183) and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving an applet-path URL, aka Bug IDs CSCup82990 and CSCuq80149."}, {"lang": "es", "value": "Vulnerabilidad de XSS en Cisco AnyConnect Secure Mobility Client 3.1(.02043) y anteriores y Cisco HostScan Engine 3.1(.05183) y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de vectores involucrando una URL de ruta de applet, tambi\u00e9n conocido como Bug IDs CSCup82990 y CSCuq80149."}], "lastModified": "2024-11-21T02:18:26.567", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:hostscan_engine:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B8EE381-AD63-4548-9AD8-6000C7BEC1FE", "versionEndIncluding": "3.1\\(.05183\\)"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7A4D4D6A-0C4A-4C79-8F56-67134E84B3C5", "versionEndIncluding": "3.1\\(.02043\\)"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}