CVE-2010-0440

Cross-site scripting (XSS) vulnerability in +CSCOT+/translation in Cisco Secure Desktop 3.4.2048, and other versions before 3.5; as used in Cisco ASA appliance before 8.2(1), 8.1(2.7), and 8.0(5); allows remote attackers to inject arbitrary web script or HTML via a crafted POST parameter, which is not properly handled by an eval statement in binary/mainv.js that writes to start.html.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

4.76% chance of exploitation in the next 30 days, 91th percentile

Published

2010-02-03

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.coresecurity.com/content/cisco-secure-desktop-xss

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/33567

References

• CVE Record
• NVD entry

Related

• CVE-2010-0437
• CVE-2010-0442
• CVE-2010-0432
• CVE-2010-0453
• CVE-2010-0426
• CVE-2010-0456