CVE-2014-8021
published 2015-02-03CVE-2014-8021: Cross-site scripting (XSS) vulnerability in Cisco AnyConnect Secure Mobility Client 3.1(.02043) and earlier and Cisco HostScan Engine 3.1(.05183) and earlier…
PriorityP420medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.79%
75.8th percentile
Cross-site scripting (XSS) vulnerability in Cisco AnyConnect Secure Mobility Client 3.1(.02043) and earlier and Cisco HostScan Engine 3.1(.05183) and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving an applet-path URL, aka Bug IDs CSCup82990 and CSCuq80149.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | anyconnect_secure_mobility_client | <= 3.1\(.02043\) | — |
| cisco | hostscan_engine | <= 3.1\(.05183\) | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_cisco4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco AnyConnect and Cisco Host Scan Web Launch Cross-Site Scripting Vulnerability
vendor_cisco·2015-02-10·CVSS 4.3
CVE-2014-8021 [MEDIUM] CWE-79 Cisco AnyConnect and Cisco Host Scan Web Launch Cross-Site Scripting Vulnerability
Cisco AnyConnect and Cisco Host Scan Web Launch Cross-Site Scripting Vulnerability
A vulnerability in Cisco AnyConnect Secure Mobility Client and Cisco Host Scan could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the client when AnyConnect is launched through the web interface.
The vulnerability is due to insufficient validation of a URL used to build a path for an applet in a Document Object Model. An attacker could exploit this vulnerability by convincing a user to click a malicious URL.
This vulnerability has been reported to Cisco by Jason Sinchak
Cisco has confirmed the vulnerability in a security notice and released software updates.
To exploit the vulnerability, the attacker may provide a link that directs a user
GHSA
GHSA-r94j-pqf7-w34w: Cross-site scripting (XSS) vulnerability in Cisco AnyConnect Secure Mobility Client 3
ghsa_unreviewed·2022-05-17
CVE-2014-8021 [MEDIUM] CWE-79 GHSA-r94j-pqf7-w34w: Cross-site scripting (XSS) vulnerability in Cisco AnyConnect Secure Mobility Client 3
Cross-site scripting (XSS) vulnerability in Cisco AnyConnect Secure Mobility Client 3.1(.02043) and earlier and Cisco HostScan Engine 3.1(.05183) and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving an applet-path URL, aka Bug IDs CSCup82990 and CSCuq80149.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8021http://tools.cisco.com/security/center/viewAlert.x?alertId=37323http://www.securityfocus.com/bid/72475https://exchange.xforce.ibmcloud.com/vulnerabilities/100666http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8021http://tools.cisco.com/security/center/viewAlert.x?alertId=37323http://www.securityfocus.com/bid/72475https://exchange.xforce.ibmcloud.com/vulnerabilities/100666
2015-02-03
Published