peter bassill · operator
$ cve CVE-2008-0533 JSON

CVE-2008-0533 EXPLOIT

4.3
MEDIUM · CVSS 2.0 · EPSS 28.8% (pctl 98)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution Engine allow remote attackers to inject arbitrary web script or HTML via an argument located immediately after the Help argument, and possibly unspecified other vectors.

Scoring

CVSS4.3 (MEDIUM, v2.0)
VectorAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS28.79% — more likely to be exploited than 98% of all CVEs
WeaknessCWE-79
On CISA KEVno
Public exploityes
Published2008-03-14
Last modified2026-06-16

Affected (3)

VendorProduct
ciscoacs for windows
ciscoacs solution engine
ciscouser changeable password

Public exploits

SourceTitleDate
exploit-dbCisco User-Changeable Password (UCP) 3.3.4.12.5 - 'CSUserCGI.exe' Help Facility Cross-Site Scripting2008-03-12

References

→ the Explorer  ·  watch your stack  ·  NVD