CVE-2014-2120 in cisco adaptive security appliance software
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.
Affected software: cisco adaptive security appliance software
Scores
- CVSS: 6.1 (medium)
- EPSS: 22.56% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2024-11-12
- Published: 2014-03-19
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Upgrade Cisco ASA software for the WebVPN login page XSS (CVE-2014-2120)
Patch or upgrade. Cross-site scripting on the ASA WebVPN login page lets attackers run script in the browser of users who open a crafted link. Fixed ASA releases listed in the Cisco advisory close it.
Applies to: Cisco ASA software with WebVPN enabled before the fixed releases in the advisory.
- Check the ASA software version with show version.
- Upgrade to a fixed release listed in the Cisco advisory or any currently supported ASA release.
- If WebVPN (clientless SSL VPN) is not used, disable it on the outside interface.
- Warn users to open the VPN portal only from bookmarks, not from links in email.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.