CVE Feed

    Dashboard / CVE / CVE-2014-3289

    CVE-2014-3289

    Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0, Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier, and Content Security Management Appliance (SMA) 8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, as demonstrated by the date_range parameter to monitor/reports/overview on the IronPort ESA, aka Bug IDs CSCun07998, CSCun07844, and CSCun07888.

    Published:Jun 10, 2014
    Last Modified:Apr 12, 2025
    EPS:Jun 10, 2014
    EPSS Score:0.0066
    CVSS Score:4.3

    Affected Products

    Vendor
    Cisco
    Product
    Content Security Management Appliance
    Vendor
    Cisco
    Product
    Email Security Appliance Firmware
    Vendor
    Cisco
    Product
    Ironport Asyncos
    Vendor
    Cisco
    Product
    Web Security Appliance

    Exploits

    http://seclists.org/fulldisclosure/2014/Jun/57http://seclists.org/fulldisclosure/2014/Jun/57

    Related CVEs

    CVE-2021-1516 (CVSS 4.3) — A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Man…
    CVE-2021-1447 (CVSS 6.7) — A vulnerability in the user account management system of Cisco AsyncOS for Cisco Content Security Management A…
    CVE-2021-1129 (CVSS 5.3) — A vulnerability in the authentication for the general purpose APIs implementation of Cisco Email Security Appl…
    CVE-2019-1983 (CVSS 5.3) — A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appl…
    CVE-2020-3117 (CVSS 4.7) — A vulnerability in the API Framework of Cisco AsyncOS for Cisco Web Security Appliance (WSA) and Cisco Content…
    CVE-2020-3547 (CVSS 4.3) — A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appli…
    CVE-2020-3447 (CVSS 5.5) — A vulnerability in the CLI of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco AsyncOS for Cis…
    CVE-2020-3178 (CVSS 6.1) — Multiple vulnerabilities in the web-based GUI of Cisco AsyncOS Software for Cisco Content Security Management …
    CVE-2020-3164 (CVSS 5.3) — A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Email Security Appliance (ESA…
    CVE-2019-12635 (CVSS 4.3) — A vulnerability in the authorization module of Cisco Content Security Management Appliance (SMA) Software coul…

    References

    http://packetstormsecurity.com/files/127004/Cisco-Ironport-Email-Security-Virtual-Appliance-8.0.0-671-XSS.html
    http://seclists.org/fulldisclosure/2014/Jun/57
    http://secunia.com/advisories/58296
    http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3289
    http://tools.cisco.com/security/center/viewAlert.x?alertId=34569
    http://www.kb.cert.org/vuls/id/613308
    http://www.securityfocus.com/bid/67943
    http://www.securitytracker.com/id/1030407
    http://packetstormsecurity.com/files/127004/Cisco-Ironport-Email-Security-Virtual-Appliance-8.0.0-671-XSS.html
    http://seclists.org/fulldisclosure/2014/Jun/57
    http://secunia.com/advisories/58296
    http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3289
    http://tools.cisco.com/security/center/viewAlert.x?alertId=34569
    http://www.kb.cert.org/vuls/id/613308
    http://www.securityfocus.com/bid/67943
    http://www.securitytracker.com/id/1030407

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High