What’s Vulnerable › Vulnerabilities

CVE-2014-3289

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-06-10 · updated 2026-06-17
• Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0, Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier, and Content Security Management Appliance (SMA) 8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, as demonstrated by the date_range parameter to monitor/reports/overview on the IronPort ESA, aka Bug IDs CSCun07998, CSCun07844, and CSCun07888.

Affected products

• Cisco Content Security Management Appliance (SMA): all versions
• Cisco Email Security Appliance: all versions
• Cisco Ironport Asyncos: through 8.0; through 8.3; 8.0
• Cisco Web Security Appliance (WSA): all versions

References

• http://packetstormsecurity.com/files/127004/Cisco-Ironport-Email-Security-Virtual-Appliance-8.0.0-671-XSS.html
• http://seclists.org/fulldisclosure/2014/Jun/57
• http://secunia.com/advisories/58296
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3289
• http://tools.cisco.com/security/center/viewAlert.x?alertId=34569
• http://www.kb.cert.org/vuls/id/613308
• http://www.securityfocus.com/bid/67943
• http://www.securitytracker.com/id/1030407
• http://packetstormsecurity.com/files/127004/Cisco-Ironport-Email-Security-Virtual-Appliance-8.0.0-671-XSS.html
• http://seclists.org/fulldisclosure/2014/Jun/57
• http://secunia.com/advisories/58296
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3289

Get alerted when CVE-2014-3289 or the next vulnerability affects your stack