CVE-2009-1201 - Vulnerability Details - OpenCVE

Description

Eval injection vulnerability in the csco_wrap_js function in /+CSCOL+/cte.js in WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass a DOM wrapper and conduct cross-site scripting (XSS) attacks by setting CSCO_WebVPN['process'] to the name of a crafted function, aka Bug ID CSCsy80694.

Published: 2009-06-25

Score: 4.3 Medium

EPSS: 4.9% Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

AND

OR	cpe:2.3:a:cisco:adaptive_security_appliance:8.0\(4\):::::::*
	cpe:2.3:a:cisco:adaptive_security_appliance:8.1.2:::::::*
	cpe:2.3:a:cisco:adaptive_security_appliance:8.2.1:::::::*

cpe:2.3:h:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.04855.

Key SSVC decision points have not yet been added.

References

Link	Providers
http://secunia.com/advisories/35511
http://www.securityfocus.com/archive/1/504516/100/0/threaded
http://www.securityfocus.com/bid/35476
http://www.securitytracker.com/id?1022457
http://www.vupen.com/english/advisories/2009/1713
https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt

History

No history.

Subscriptions

Cisco Adaptive Security Appliance

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2009-06-25T17:00:00.000Z

Updated: 2024-08-07T05:04:49.338Z

Reserved: 2009-03-31T00:00:00.000Z

Link: CVE-2009-1201

Vulnrichment

No data.

NVD

Status : Modified

Published: 2009-06-25T17:30:00.203

Modified: 2026-04-23T00:35:47.467

Link: CVE-2009-1201

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-79

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-06-24T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Eval injection vulnerability in the csco_wrap_js function in /+CSCOL+/cte.js in WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass a DOM wrapper and conduct cross-site scripting (XSS) attacks by setting CSCO_WebVPN['process'] to the name of a crafted function, aka Bug ID CSCsy80694."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-10T18:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "35476", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/35476"}, {"tags": ["x_refsource_MISC"], "url": "https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt"}, {"name": "20090624 Trustwave's SpiderLabs Security Advisory TWSL2009-002", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/504516/100/0/threaded"}, {"name": "1022457", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1022457"}, {"name": "ADV-2009-1713", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2009/1713"}, {"name": "35511", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/35511"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2009-1201", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Eval injection vulnerability in the csco_wrap_js function in /+CSCOL+/cte.js in WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass a DOM wrapper and conduct cross-site scripting (XSS) attacks by setting CSCO_WebVPN['process'] to the name of a crafted function, aka Bug ID CSCsy80694."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "35476", "refsource": "BID", "url": "http://www.securityfocus.com/bid/35476"}, {"name": "https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt", "refsource": "MISC", "url": "https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt"}, {"name": "20090624 Trustwave's SpiderLabs Security Advisory TWSL2009-002", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/504516/100/0/threaded"}, {"name": "1022457", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1022457"}, {"name": "ADV-2009-1713", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2009/1713"}, {"name": "35511", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/35511"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T05:04:49.338Z"}, "title": "CVE Program Container", "references": [{"name": "35476", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/35476"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt"}, {"name": "20090624 Trustwave's SpiderLabs Security Advisory TWSL2009-002", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/504516/100/0/threaded"}, {"name": "1022457", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1022457"}, {"name": "ADV-2009-1713", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2009/1713"}, {"name": "35511", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/35511"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2009-1201", "datePublished": "2009-06-25T17:00:00.000Z", "dateReserved": "2009-03-31T00:00:00.000Z", "dateUpdated": "2024-08-07T05:04:49.338Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance:8.0\\(4\\):*:*:*:*:*:*:*", "matchCriteriaId": "98CBFBF5-966C-48E8-BAFB-DED4E58098F1", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance:8.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "13BC5744-8EB0-4BE3-A743-E95BCD6E2CC2", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance:8.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "7853F676-A9A4-4980-B698-19C60F4DD71F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:*", "matchCriteriaId": "7D80DB80-F243-469B-993F-E368B092B3C5", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Eval injection vulnerability in the csco_wrap_js function in /+CSCOL+/cte.js in WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass a DOM wrapper and conduct cross-site scripting (XSS) attacks by setting CSCO_WebVPN['process'] to the name of a crafted function, aka Bug ID CSCsy80694."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n \"Eval\" en la funci\u00f3n csco_wrap_js en /+CSCOL+/cte.js en WebVPN en los dispositivos Cisco Adaptive Security Appliances (ASA) con software 8.0(4), 8.1.2, y 8.2.1, permite a atacantes remotos eludir un envoltorio (wrapper) DOM y realizar ataques de secuencias de comandos en sitios cruzados (XSS) configurando el valor CSCO_WebVPN['process'] con el nombre de la funci\u00f3n modificada, alias Bug ID CSCsy80694."}], "id": "CVE-2009-1201", "lastModified": "2026-04-23T00:35:47.467", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2009-06-25T17:30:00.203", "references": [{"source": "cve@mitre.org", "url": "http://secunia.com/advisories/35511"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/504516/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/35476"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id?1022457"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2009/1713"}, {"source": "cve@mitre.org", "url": "https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/35511"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/504516/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/35476"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1022457"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2009/1713"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}