CVE-2014-8021 Cross-site scripting in n/a

What is CVE-2014-8021?

CVE-2014-8021 is a medium-severity cross-site scripting vulnerability in Cisco Anyconnect Secure Mobility Client, published on 3 Feb 2015. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross-site scripting (XSS) vulnerability in Cisco AnyConnect Secure Mobility Client 3.1(.02043) and earlier and Cisco HostScan Engine 3.1(.05183) and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving an applet-path URL, aka Bug IDs CSCup82990 and CSCuq80149.

Weakness: CWE-79

Which versions are affected by CVE-2014-8021?

It affects 2 products.

Products include Cisco Anyconnect Secure Mobility Client, Cisco Hostscan Engine.

How do I fix CVE-2014-8021?

No fix has been published for CVE-2014-8021 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2014-8021 being exploited?

There is no known exploitation of CVE-2014-8021 in the wild and no public exploit code.

Other vulnerabilities in Cisco Anyconnect Secure Mobility Client

• CVE-2020-3433 Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Exploited High 7.8
• CVE-2020-3153 Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Exploited Medium 6.5
• CVE-2012-3088 Security feature bypass in n/a Critical 9.3
• CVE-2012-2493 Code injection in n/a Critical 9.3
• CVE-2011-2040 Code injection in n/a Critical 9.3

All Cisco Anyconnect Secure Mobility Client vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r94j-pqf7-w34w.