CVE-2015-0698
published 2015-04-15CVE-2015-0698: Multiple cross-site scripting (XSS) vulnerabilities in filter search forms in admin web pages on Cisco Web Security Appliance (WSA) devices with software…
PriorityP418medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.55%
72.2th percentile
Multiple cross-site scripting (XSS) vulnerabilities in filter search forms in admin web pages on Cisco Web Security Appliance (WSA) devices with software 8.5.0-497 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut39213.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | web_security_appliance | <= 8.5.0-497 | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_cisco4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-297g-9658-43jh: Multiple cross-site scripting (XSS) vulnerabilities in filter search forms in admin web pages on Cisco Web Security Appliance (WSA) devices with softw
ghsa_unreviewed·2022-05-17
CVE-2015-0698 [MEDIUM] CWE-79 GHSA-297g-9658-43jh: Multiple cross-site scripting (XSS) vulnerabilities in filter search forms in admin web pages on Cisco Web Security Appliance (WSA) devices with softw
Multiple cross-site scripting (XSS) vulnerabilities in filter search forms in admin web pages on Cisco Web Security Appliance (WSA) devices with software 8.5.0-497 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut39213.
Cisco
Cisco Web Security Appliance Cross-Site Scripting Vulnerability
vendor_cisco·2015-04-14·CVSS 4.3
CVE-2015-0698 [MEDIUM] CWE-79 Cisco Web Security Appliance Cross-Site Scripting Vulnerability
Cisco Web Security Appliance Cross-Site Scripting Vulnerability
A vulnerability in filter search forms of certain admin webpages of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability is due to insufficient input validation by an affected device. An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to visit a malicious website. If successful, the attacker could have the ability to execute arbitrary scripts in the user's browser session or gain access to sensitive information.
Cisco has confirmed the vulnerability; however, software updates are not available.
To exploit the vulnerability, the attacker may provide a link that directs a user to a malici
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2015-04-15
Published