Unscored severity · published Mar 14, 2008
CVE-2008-0533
Multiple cross-site scripting (XSS) vulnerabilities in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for…
–
CVSS
28.8%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution Engine allow remote attackers to inject arbitrary web script or HTML via an argument located immediately after the Help argument, and possibly unspecified other vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)28.8% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Acs For Windows · Cisco
All versions, or not specified · source: NVD
AS
Acs Solution Engine · Cisco
All versions, or not specified · source: NVD
UC
User Changeable Password · Cisco
4.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-0533
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-0533
Patch
http://secunia.com/advisories/29351
securityreason.com
http://securityreason.com/securityalert/3743
securitytracker.com
http://securitytracker.com/id?1019607
Patch
http://www.cisco.com/en/US/products/products_security_advisory09186a008095f0c4.shtml
www.recurity-labs.com
http://www.recurity-labs.com/content/pub/RecurityLabs_Cisco_ACS_UCP_advisory.txt
www.securityfocus.com
http://www.securityfocus.com/archive/1/489463/100/0/threaded
More from Acs For Windows
–
CVE-2008-0532
Multiple buffer overflows in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution…