CVE-2009-1201 - Vulnerability Details - OpenCVE

Eval injection vulnerability in the csco_wrap_js function in /+CSCOL+/cte.js in WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass a DOM wrapper and conduct cross-site scripting (XSS) attacks by setting CSCO_WebVPN['process'] to the name of a crafted function, aka Bug ID CSCsy80694.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.04855.

Key SSVC decision points have not yet been added.

Vendors	Products
Cisco Subscribe	Adaptive Security Appliance Subscribe

Configuration 1 [-]

AND

OR	cpe:2.3:a:cisco:adaptive_security_appliance:8.0\(4\):::::::*
	cpe:2.3:a:cisco:adaptive_security_appliance:8.1.2:::::::*
	cpe:2.3:a:cisco:adaptive_security_appliance:8.2.1:::::::*

cpe:2.3:h:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://secunia.com/advisories/35511
http://www.securityfocus.com/archive/1/504516/100/0/threaded
http://www.securityfocus.com/bid/35476
http://www.securitytracker.com/id?1022457
http://www.vupen.com/english/advisories/2009/1713
https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2009-06-25T17:00:00

Updated: 2024-08-07T05:04:49.338Z

Reserved: 2009-03-31T00:00:00

Link: CVE-2009-1201

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2009-06-25T17:30:00.203

Modified: 2025-04-09T00:30:58.490

Link: CVE-2009-1201

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-79

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-06-24T00:00:00", "descriptions": [{"lang": "en", "value": "Eval injection vulnerability in the csco_wrap_js function in /+CSCOL+/cte.js in WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass a DOM wrapper and conduct cross-site scripting (XSS) attacks by setting CSCO_WebVPN['process'] to the name of a crafted function, aka Bug ID CSCsy80694."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-10T18:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "35476", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/35476"}, {"tags": ["x_refsource_MISC"], "url": "https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt"}, {"name": "20090624 Trustwave's SpiderLabs Security Advisory TWSL2009-002", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/504516/100/0/threaded"}, {"name": "1022457", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1022457"}, {"name": "ADV-2009-1713", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2009/1713"}, {"name": "35511", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/35511"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2009-1201", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Eval injection vulnerability in the csco_wrap_js function in /+CSCOL+/cte.js in WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass a DOM wrapper and conduct cross-site scripting (XSS) attacks by setting CSCO_WebVPN['process'] to the name of a crafted function, aka Bug ID CSCsy80694."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "35476", "refsource": "BID", "url": "http://www.securityfocus.com/bid/35476"}, {"name": "https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt", "refsource": "MISC", "url": "https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt"}, {"name": "20090624 Trustwave's SpiderLabs Security Advisory TWSL2009-002", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/504516/100/0/threaded"}, {"name": "1022457", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1022457"}, {"name": "ADV-2009-1713", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2009/1713"}, {"name": "35511", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/35511"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T05:04:49.338Z"}, "title": "CVE Program Container", "references": [{"name": "35476", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/35476"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt"}, {"name": "20090624 Trustwave's SpiderLabs Security Advisory TWSL2009-002", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/504516/100/0/threaded"}, {"name": "1022457", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1022457"}, {"name": "ADV-2009-1713", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2009/1713"}, {"name": "35511", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/35511"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2009-1201", "datePublished": "2009-06-25T17:00:00", "dateReserved": "2009-03-31T00:00:00", "dateUpdated": "2024-08-07T05:04:49.338Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance:8.0\\(4\\):*:*:*:*:*:*:*", "matchCriteriaId": "98CBFBF5-966C-48E8-BAFB-DED4E58098F1", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance:8.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "13BC5744-8EB0-4BE3-A743-E95BCD6E2CC2", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance:8.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "7853F676-A9A4-4980-B698-19C60F4DD71F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:*", "matchCriteriaId": "7D80DB80-F243-469B-993F-E368B092B3C5", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Eval injection vulnerability in the csco_wrap_js function in /+CSCOL+/cte.js in WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass a DOM wrapper and conduct cross-site scripting (XSS) attacks by setting CSCO_WebVPN['process'] to the name of a crafted function, aka Bug ID CSCsy80694."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n \"Eval\" en la funci\u00f3n csco_wrap_js en /+CSCOL+/cte.js en WebVPN en los dispositivos Cisco Adaptive Security Appliances (ASA) con software 8.0(4), 8.1.2, y 8.2.1, permite a atacantes remotos eludir un envoltorio (wrapper) DOM y realizar ataques de secuencias de comandos en sitios cruzados (XSS) configurando el valor CSCO_WebVPN['process'] con el nombre de la funci\u00f3n modificada, alias Bug ID CSCsy80694."}], "id": "CVE-2009-1201", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2009-06-25T17:30:00.203", "references": [{"source": "cve@mitre.org", "url": "http://secunia.com/advisories/35511"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/504516/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/35476"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id?1022457"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2009/1713"}, {"source": "cve@mitre.org", "url": "https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/35511"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/504516/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/35476"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1022457"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2009/1713"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}