CVE-2014-2120

Katalog CVE

CVSS 6.1 · Medium KEV · sudah dieksploitasi EPSS 22,6%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada cisco adaptive security appliance software. Skor CVSS 3.1 6.1 (Medium) menurut NVD. Masuk katalog KEV CISA pada 12 November 2024, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.

Rincian

Terbit di NVD

19 Maret 2014

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

22,6% peluang dieksploitasi; lebih tinggi dari 97,6% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability

Masuk KEV

12 November 2024

Tenggat CISA

3 Desember 2024 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2120 broken link · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-2120 pemerintah AS
• http://www.securityfocus.com/bid/66290 broken link · advisory pihak ketiga · vdb entry
• http://www.securitytracker.com/id/1029935 broken link · advisory pihak ketiga · vdb entry