Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability

Technical Severity

CVSS v3.1 Metrics

MEDIUM

5.4 / 10

Minimal Risk Critical

Vector Specification

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitation Likelihood

EPSS Prediction

69.04 %

Predictive Probability

Percentile Rank

98.6 th

Documented as more likely to be exploited than 98.6% of known CVEs.

Detection Date

Nov 12, 2024

Remediation Due

Dec 03, 2024

CISA Catalog Active

Threat Analysis

Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.

Remediation Directive

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Asset Context

Vendor Identity

Cisco

Affected Product

Adaptive Security Appliance (ASA)

Ransomware Status

Campaign Use Unknown

Weakness Classification

CWE-79

External Intelligence

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CVE-2014-2120

NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2014-2120