CVE-2015-0698 Cross-site scripting in n/a

What is CVE-2015-0698?

CVE-2015-0698 is a medium-severity cross-site scripting vulnerability in Cisco Web Security Appliance, published on 15 Apr 2015. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Multiple cross-site scripting (XSS) vulnerabilities in filter search forms in admin web pages on Cisco Web Security Appliance (WSA) devices with software 8.5.0-497 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut39213.

Weakness: CWE-79

Which versions are affected by CVE-2015-0698?

It affects 1 product.

Products include Cisco Web Security Appliance.

How do I fix CVE-2015-0698?

No fix has been published for CVE-2015-0698 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2015-0698 being exploited?

There is no known exploitation of CVE-2015-0698 in the wild and no public exploit code.

Other vulnerabilities in Cisco Web Security Appliance

• CVE-2015-6298 Command injection in n/a Critical 9.0
• CVE-2019-1817 Cisco Web Security Appliance Malformed Request Denial of Service Vulnerability High 8.6
• CVE-2018-0410 Denial of service in AsyncOS Software for Cisco Web Security Appliances High 8.6
• CVE-2015-6292 Denial of service in n/a High 7.8
• CVE-2015-6293 Denial of service in n/a High 7.8

All Cisco Web Security Appliance vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-297g-9658-43jh.