Detections
Analytics
Cisco ASA WebVPN XSS
medium Nessus Plugin ID 69138
Language:
Synopsis
The remote security device is missing a vendor-supplied security patch.Description
According to its self-reported version, the remote Cisco ASA is missing a security patch and is affected by a cross-site scripting vulnerability in the WebVPN portal login page. An attacker could exploit this by tricking a user into requesting a specially crafted URL, resulting in arbitrary script code execution.Solution
According to the Cisco Security Notice for CVE-2013-3414, fixes can be obtained by contacting normal support channels.See Also
http://www.nessus.org/u?bc0e96e5
https://tools.cisco.com/security/center/viewAlert.x?alertId=30214
Plugin Details
Severity: Medium
ID: 69138
File Name: cisco_asa_CSCug83080.nasl
Version: 1.12
Type: local
Family: CISCO
Published: 7/30/2013
Updated: 11/27/2019
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 1.6
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS v3
Risk Factor: Medium
Base Score: 4.7
Temporal Score: 4.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:cisco:adaptive_security_appliance_software
Required KB Items: Host/Cisco/ASA
Exploit Ease: No known exploits are available
Patch Publication Date: 7/25/2013
Vulnerability Publication Date: 7/25/2013
Reference Information
CVE: CVE-2013-3414
BID: 61451