CWE Code: 79
Vulnerability Type: privilege_escalation
CVSS Score: 3.5
CWE Name:  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary: multiple vulnerabilities in the webvpn service of cisco adaptive security appliance (asa) software and cisco firepower threat defense (ftd) software could allow an authenticated, remote attacker to conduct a cross-site scripting (xss) attack against a user of the webvpn portal of an affected device. the vulnerabilities exist because the software insufficiently validates user-supplied input on an affected device. an attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. a successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. an attacker would need administrator privileges on the device to exploit these vulnerabilities.
Access Authentication: SINGLE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): NONE/PARTIAL/NONE
Published Date: 2019-05-03
Last Modified Date: 2019-10-09