Actively exploited · Published Mar 19, 2014 · Assigned by cisco

CVE-2014-2120

Medium 5.4 Exploited

In plain English

A medium-severity cross-site scripting in Adaptive Security Appliance (ASA) from Cisco. Attackers are actively exploiting it in the wild (listed by CISA on November 12, 2024). The chance it is exploited in the next 30 days is estimated at 22.6% (higher than 98% of all known vulnerabilities). Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)22.6%top 2.3% of all CVEs

Exploited in the wildYesCISA KEV since Nov 12, 2024

Attack toolingNoneno public tooling known

CISA guidance

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Dec 3, 2024.

Official description

Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

1029935 vdb-entry, x_refsource_SECTRACK
20140318 Cisco Adaptive Security Appliance WebVPN Login Page Cross-Site Scripting Vulnerability vendor-advisory, x_refsource_CISCO
66290 vdb-entry, x_refsource_BID
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-2120 government-resource