CVE-2014-2120 — VulnIntel

CVE-2014-2120

MEDIUM

KEV

Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.

StatusAnalyzed

설명

Score Summary

CVSS Score: 6.1
Version: 3.1
VPI: 91.50
Why this VPI (explainable, experimental)
VPI breakdown
Impact 61.00
Exploitation signal(KEV listed) ×1.50
VPI 91.50
VPI formula vpi-v1
EPSS: 14.0%
(상위 96.2%)
Attack Vector: Network
Low Complexity
No Privileges
User Interaction Required
Scope Changed
Low Confidentiality Impact
Low Integrity Impact
No Availability Impact

Details

Published: 03/19/2014(12 years ago)
Modified: 04/21/2026(3 months ago)
Source: KEV, NVD
Products: 1

CISA KEV Listing

Vendor / Project: Cisco
Product: Adaptive Security Appliance (ASA)

Date Added: 11/12/2024
Due Date: 12/03/2024Overdue 596d

Required Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vulnerability Lifecycle

NVDPublished03/19/2014
CISA KEVKEV Listed11/12/2024
CISA KEV

Score Comparison by Source

Source	CVSS Version	Base Score	Severity	Vector String	Assessment Date
NVDNIST	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	04/20/2026
NVDNIST	2.0	4.3

CWE Weakness Classification

CWE-79
NVD
Secondary

References (4)

NVD
Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2120
NVD
Third Party Advisory
http://www.securityfocus.com/bid/66290
NVD
Third Party Advisory

Affected Products (1)

Impact	61.00
Exploitation signal(KEV listed)	×1.50
VPI	91.50