Medium · published October 21, 2020
CVSS calls it medium at 6.1. It is confirmed in active exploitation. It sits in the 99.7th percentile for exploit probability.
⚠️ An unauthenticated click could give an attacker the keys to your web interface! This XSS vulnerability in Cisco ASA and FTD Software is like a prankster convincing a user to open a spoofed link. 😱 Think of it as a restaurant where a waiter serves a dish labeled 'safe' but actually contains allergens — without proper validation, the user might take a bite and suffer the consequences. If they click that crafted link, it could unleash a script that wreaks havoc! If an attacker successfully exploits this vulnerability, they can run arbitrary scripts in the context of the web service interface. This means they could access sensitive browser-based information or even manipulate user actions in a potentially harmful way, leading to unauthorized access or data leaks. Absolutely devastating!
Think of it as a restaurant where a waiter serves a dish labeled 'safe' but actually contains allergens — without proper validation, the user might take a bite and suffer the consequences. If they click that crafted link, it could unleash a script that wreaks havoc! These vulnerabilities arise from inadequate validation of user-supplied input in Cisco's web services interface, allowing attackers to execute cross-site scripting attacks without requiring authentication.
If an attacker successfully exploits this vulnerability, they can run arbitrary scripts in the context of the web service interface. This means they could access sensitive browser-based information or even manipulate user actions in a potentially harmful way, leading to unauthorized access or data leaks. Absolutely devastating! To protect yourself, ensure that you're using the latest version of Cisco ASA and FTD Software. Update to the fixed versions as soon as possible, and train your users to be wary of suspicious links, especially in their web service interfaces. Don't let them fall for the bait! You've got this! Follow these steps and secure your web services interface. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| cisco/secure_firewall_threat_defense | < 6.4.0.12 | 6.4.0.12 |
| cisco/secure_firewall_threat_defense | ≥ 6.5.0, < 6.6.4 | 6.6.4 |
| cisco/secure_firewall_threat_defense | ≥ 6.7.0, < 6.7.0.2 | 6.7.0.2 |
| cisco/adaptive_security_appliance_software | < 9.8.4.34 | 9.8.4.34 |
| cisco/adaptive_security_appliance_software | ≥ 9.9, < 9.9.2.85 | 9.9.2.85 |
| cisco/adaptive_security_appliance_software | ≥ 9.10, < 9.12.4.13 | 9.12.4.13 |
| cisco/adaptive_security_appliance_software | ≥ 9.13, < 9.13.1.21 | 9.13.1.21 |
| cisco/adaptive_security_appliance_software | ≥ 9.14, < 9.14.2.8 | 9.14.2.8 |
| cisco/adaptive_security_appliance_software | ≥ 9.15, < 9.15.1.15 | 9.15.1.15 |