Test ID:	1.3.6.1.4.1.25623.1.0.105986
Category:	CISCO
Title:	Cisco ASA Clientless SSL VPN Portal Customization Integrity Vulnerability (cisco-sa-20141008-asa)
Summary:	A vulnerability in the Clientless SSL VPN portal customization; framework could allow an unauthenticated, remote attacker to modify the content of the Clientless; SSL VPN portal, which could lead to several attacks including the stealing of credentials,; cross-site scripting (XSS), and other types of web attacks on the client using the affected; system.
Description:	Summary: A vulnerability in the Clientless SSL VPN portal customization framework could allow an unauthenticated, remote attacker to modify the content of the Clientless SSL VPN portal, which could lead to several attacks including the stealing of credentials, cross-site scripting (XSS), and other types of web attacks on the client using the affected system. Vulnerability Insight: The vulnerability is due to an improper implementation of authentication checks in the Clientless SSL VPN portal customization framework. An unauthenticated, remote attacker could exploit this vulnerability by modifying some of the customization objects in the RAMFS cache file system. Vulnerability Impact: An exploit could allow the attacker to bypass Clientless SSL VPN authentication and modify the portal content. If successful, the attacker could conduct web-based attacks against a client using the affected software, which could be used to access sensitive information. Affected Software/OS: Cisco ASA version 8.2, 8.3, 8.4, 8.6, 9.0, 9.1 and 9.2. Solution: See the referenced vendor advisory for a solution. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-3393 Cisco Security Advisory: 20141008 Multiple Vulnerabilities in Cisco ASA Software http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141008-asa
Copyright	Copyright (C) 2015 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.