CVE-2009-1202

EUVD-2009-1201
WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass certain protection mechanisms involving URL rewriting and HTML rewriting, and conduct cross-site scripting (XSS) attacks, by modifying the first hex-encoded character in a /+CSCO+ URI, aka Bug ID CSCsy80705.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 54%
Affected Products (NVD)
VendorProductVersion
ciscoadaptive_security_appliance
8.0\(4\)
ciscoadaptive_security_appliance
8.1.2
ciscoadaptive_security_appliance
8.2.1
ciscoadaptive_security_appliance
*
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://secunia.com/advisories/35511
http://www.securityfocus.com/archive/1/504516/100/0/threaded
http://www.securityfocus.com/bid/35480
http://www.securitytracker.com/id?1022457
http://www.vupen.com/english/advisories/2009/1713
http://secunia.com/advisories/35511
http://www.securityfocus.com/archive/1/504516/100/0/threaded
http://www.securityfocus.com/bid/35480
http://www.securitytracker.com/id?1022457
http://www.vupen.com/english/advisories/2009/1713