Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2010-0440 — Cross-site Scripting in Cisco Adaptive Security Appliance Software

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
39.3%
top 2.70%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Cisco Adaptive Security Appliance SoftwareCisco Secure Desktop
Timeline
PublishedFeb 3
Latest updateMay 2

Description

Cross-site scripting (XSS) vulnerability in +CSCOT+/translation in Cisco Secure Desktop 3.4.2048, and other versions before 3.5; as used in Cisco ASA appliance before 8.2(1), 8.1(2.7), and 8.0(5); allows remote attackers to inject arbitrary web script or HTML via a crafted POST parameter, which is not properly handled by an eval statement in binary/mainv.js that writes to start.html.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages2 packages

Patches

Patch: tools.cisco.com ↗Patch: tools.cisco.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-v9jr-23rj-wr7x: Cross-site scripting (XSS) vulnerability in +CSCOT+/translation in Cisco Secure Desktop 3↗2022-05-02
▶
CVEList
CVE-2010-0440: Cross-site scripting (XSS) vulnerability in +CSCOT+/translation in Cisco Secure Desktop 3↗2010-02-03
▶

💥Exploits & PoCs

1
Exploit-DB
Cisco Secure Desktop 3.x - 'translation' Cross-Site Scripting↗2010-01-26
▶

📋Vendor Advisories

1
Cisco
Cisco Secure Desktop Remote Cross-Site Scripting Vulnerability↗2010-02-01
▶
CVE-2010-0440 — Cross-site Scripting in Cisco | cvebase