CVE-2009-1162
UnknownEPSS 1.22%
Last modified
CVE-2009-1162 is a vulnerability of currently unknown severity. Cross-site scripting (XSS) vulnerability in the Spam Quarantine login page in Cisco IronPort AsyncOS before 6.5.2 on Series C, M, and X appliances allows remote attackers to inject arbitrary web script or HTML via the referrer parameter.. EPSS estimates a 1.22% chance of exploitation in the next 30 days.
Description
Cross-site scripting (XSS) vulnerability in the Spam Quarantine login page in Cisco IronPort AsyncOS before 6.5.2 on Series C, M, and X appliances allows remote attackers to inject arbitrary web script or HTML via the referrer parameter.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Cisco | Ironport Asyncos | 6.0.0-754 | — |
| Cisco | Ironport Asyncos | 6.0.0-757 | — |
| Cisco | Ironport Asyncos | 6.1.0-301 | — |
| Cisco | Ironport Asyncos | 6.1.0-304 | — |
| Cisco | Ironport Asyncos | 6.1.0-306 | — |
| Cisco | Ironport Asyncos | 6.1.0-307 | — |
| Cisco | Ironport Asyncos | 6.1.5-110 | — |
| Cisco | Ironport Asyncos | 6.1.6-003 | — |
| Cisco | Ironport Asyncos | 6.3.5-003 | — |
| Cisco | Ironport Asyncos | 6.3.6-003 | — |
| Cisco | Ironport Asyncos | 6.5.0-405 | — |
| Cisco | Ironport Asyncos | 6.5.1-005 | — |
| Cisco | Ironport Asyncos | 6.6.4.0-273 | — |
| Cisco | Ironport Email Security Appliances | All versions | C |
References
- http://secunia.com/advisories/34895Vendor Advisory
- http://secunia.com/advisories/34895Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2009-1162?
Cross-site scripting (XSS) vulnerability in the Spam Quarantine login page in Cisco IronPort AsyncOS before 6.5.2 on Series C, M, and X appliances allows remote attackers to inject arbitrary web script or HTML via the referrer parameter.
How severe is CVE-2009-1162?
Severity scoring for CVE-2009-1162 is pending analysis. The EPSS model estimates a 1.22% probability of exploitation in the next 30 days.
How do I fix CVE-2009-1162?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2009
- CVE-2009-1156Unspecified vulnerability on Cisco Adaptive Security Applian…
- CVE-2009-1157Memory leak on Cisco Adaptive Security Appliances (ASA) 5500…
- CVE-2009-1158Unspecified vulnerability on Cisco Adaptive Security Applian…
- CVE-2009-1159Unspecified vulnerability on Cisco Adaptive Security Applian…
- CVE-2009-1160Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX…
- CVE-2009-1161Directory traversal vulnerability in the TFTP service in Cis…
- CVE-2009-1163Memory leak on the Cisco Physical Access Gateway with softwa…
- CVE-2009-1164The administrative web interface on the Cisco Wireless LAN C…
- CVE-2009-1165Memory leak on the Cisco Wireless LAN Controller (WLC) platf…
- CVE-2009-1166The administrative web interface on the Cisco Wireless LAN C…
- CVE-2009-1167Unspecified vulnerability on the Cisco Wireless LAN Controll…
- CVE-2009-1168Cisco IOS 12.0(32)S12 through 12.0(32)S13 and 12.0(33)S3 thr…
Are you affected by CVE-2009-1162?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST