Unscored severity · published Jun 19, 2006
CVE-2006-3073
Multiple cross-site scripting (XSS) vulnerabilities in the WebVPN feature in the Cisco VPN 3000 Series Concentrators and Cisco ASA 5500 Series Adaptive Security Appliances (ASA),…
–
CVSS
1.7%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the WebVPN feature in the Cisco VPN 3000 Series Concentrators and Cisco ASA 5500 Series Adaptive Security Appliances (ASA), when in WebVPN clientless mode, allow remote attackers to inject arbitrary web script or HTML via the domain parameter in (1) dnserror.html and (2) connecterror.html, aka bugid CSCsd81095 (VPN3k) and CSCse48193 (ASA). NOTE: the vendor states that "WebVPN full-network-access mode" is not affected, despite the claims by the original researcher.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A5
Asa 5500 · Cisco
7.0; 7.0(4); 7.0.4.3 · source: NVD
V3
Vpn 3000 Concentrator Series Software · Cisco
2.0; 2.5.2.a; 2.5.2.b; 2.5.2.c; 2.5.2.d; 2.5.2.f; +29 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-3073
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-3073
Vendor Advisory
http://secunia.com/advisories/20644
Exploit
http://securitytracker.com/id?1016252
www.cisco.com
http://www.cisco.com/warp/public/707/cisco-sr-20060613-webvpn-xss.shtml
www.osvdb.org
http://www.osvdb.org/26453
www.osvdb.org
http://www.osvdb.org/26454
www.securityfocus.com
http://www.securityfocus.com/archive/1/436479/30/0/threaded
More from Asa 5500
–
CVE-2013-0149
The OSPF implementation in Cisco IOS 12.0 through 12.4 and 15.0 through 15.3, IOS-XE 2.x through 3.9.xS, ASA and PIX 7.x through 9.1, FWSM, NX-OS, and StarOS before 14.0.50488…
–
CVE-2013-1215
The vpnclient program in the Easy VPN component on Cisco Adaptive Security Appliances (ASA) 5505 devices allows local users to gain privileges via unspecified vectors, aka Bug ID…
–
CVE-2012-6395
Cisco Adaptive Security Appliances (ASA) devices with firmware 8.4 do not properly validate unspecified input related to UNC share pathnames, which allows remote authenticated…
–
CVE-2012-5717
Cisco Adaptive Security Appliances (ASA) devices with firmware 8.x through 8.4(1) do not properly manage SSH sessions, which allows remote authenticated users to cause a denial of…
–
CVE-2011-3304
Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services module in Cisco Catalyst 6500 series devices, with software 7.2 before 7.2(5.3), 8.0 before…