CVE-2014-2120

MediumCVSS 6.1/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
cisco	adaptive_security_appliance_software	< *

References

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2120Broken Link, Vendor Advisory
http://www.securityfocus.com/bid/66290Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029935Broken Link, Third Party Advisory, VDB Entry
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2120Broken Link, Vendor Advisory
http://www.securityfocus.com/bid/66290Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029935Broken Link, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-2120US Government Resource

Timeline

Published: Mar 19, 2014
Last modified: Jun 17, 2026
Added to CISA KEV: Nov 12, 2024
NVD status: Analyzed

Related CVEs from 2014

CVE-2014-21215.0The Java-based software in Cisco Hosted Collaboration Solution (HCS) allows remote attackers to cause a denial of service (closing of TCP po CVE-2014-21225.0Memory leak in the GUI in the Impact server in Cisco Hosted Collaboration Solution (HCS) allows remote attackers to cause a denial of servic CVE-2014-21247.1Cisco IOS 15.1(2)SY3 and earlier, when used with Supervisor Engine 2T (aka Sup2T) on Catalyst 6500 devices, allows remote attackers to cause CVE-2014-21254.3Cross-site scripting (XSS) vulnerability in the Web Inbox in Cisco Unity Connection 8.6(2a)SU3 and earlier allows remote attackers to inject CVE-2014-21268.5Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.47), 8.4 before 8.4(7.5), 8.7 before 8.7(1.11), 9.0 before 9.0(3.10), and CVE-2014-21278.5Cisco Adaptive Security Appliance (ASA) Software 8.x before 8.2(5.48), 8.3 before 8.3(2.40), 8.4 before 8.4(7.9), 8.6 before 8.6(1.13), 9.0 CVE-2014-21285.0The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.47, 8.3 before 8.3(2.40), 8.4 before 8.4(7.3 CVE-2014-21297.1The SIP inspection engine in Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.48), 8.4 before 8.4(6.5), 9.0 before 9.0(3.1)CVE-2014-21306.5Cisco Secure Access Control Server (ACS) provides an unintentional administration web interface based on Apache Tomcat, which allows remote CVE-2014-21316.1The packet driver in Cisco IOS allows remote attackers to cause a denial of service (device reload) via a series of (1) Virtual Switching Sy CVE-2014-21327.8Cisco WebEx Recording Format (WRF) player and Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 bef CVE-2014-21339.3Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remo