CVE-2014-2120

MEDIUM(6.1)KEVElevated Risk

Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability

Description

Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.

KEV Information

Vendor
Cisco
Product
Adaptive Security Appliance (ASA)
Date Added
November 12, 2024
Due Date
December 3, 2024
Required Action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CVSS Score

Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NOpen in Calculator
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
Exploitability Score
2.8
Impact Score
2.7

CWEs

CWE-79Cross-site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation

Affected Products

VendorProductVersion
ciscoadaptive security appliance software-

Multiple CVSS Assessments

Source: [email protected](Primary)
6.1
MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0(Secondary)
5.4
MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

CVSS Score

6.1
MEDIUM(6.1)

EPSS Score

EPSS Score14.03%
EPSS Percentile96.2%

Dates

PublishedMarch 19, 2014
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch