CVE-2019-1701— Cisco Adaptive Security Appliance Software和Firepower Threat Defense Software 跨站脚本漏洞

Cisco Adaptive Security Appliance and Firepower Threat Defense Software WebVPN Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the WebVPN service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the WebVPN portal of an affected device. The vulnerabilities exist because the software insufficiently validates user-supplied input on an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. An attacker would need administrator privileges on the device to exploit these vulnerabilities.

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Cisco Adaptive Security Appliance Software和Firepower Threat Defense Software 跨站脚本漏洞

Cisco ASA Software和Cisco FTD Software中的WebVPN服务存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。以下产品及版本受到影响：Cisco 3000 Series Industrial Security Appliances；ASA 1000V Cloud Firewall；ASA 5500-X Series Firewalls；ASA 5505 Adaptive Security Appliance；ASA Ser

N/A

N/A