Unscored severity · published Jul 29, 2015
CVE-2015-0732
Cross-site scripting (XSS) vulnerability in Cisco AsyncOS on the Web Security Appliance (WSA) 9.0.0-193; Email Security Appliance (ESA) 8.5.6-113, 9.1.0-032, 9.1.1-000, and…
–
CVSS
1.8%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Cisco AsyncOS on the Web Security Appliance (WSA) 9.0.0-193; Email Security Appliance (ESA) 8.5.6-113, 9.1.0-032, 9.1.1-000, and 9.6.0-000; and Content Security Management Appliance (SMA) 9.1.0-033 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug IDs CSCuu37430, CSCuu37420, CSCut71981, and CSCuv50167.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Content Security Management Virtual Appliance · Cisco
9.1.0-033 · source: NVD
ES
Email Security Appliance Firmware · Cisco
8.5.6-113; 9.1.0-032; 9.1.1-000; 9.6.0-000 · source: NVD
WS
Web Security Appliance · Cisco
9.0.0-193 · source: NVD
Affected product
CS
Content Security Management Virtual Appliance
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0732
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0732
Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=40172
www.securitytracker.com
http://www.securitytracker.com/id/1033086
www.securitytracker.com
http://www.securitytracker.com/id/1033087
More from Content Security Management Virtual Appliance
–
CVE-2015-4217
The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before…
–
CVE-2015-4216
The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before…