{"api_version":"1","generated_at":"2026-07-23T10:14:18+00:00","cve":"CVE-2014-8028","urls":{"html":"https://cve.report/CVE-2014-8028","api":"https://cve.report/api/cve/CVE-2014-8028.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-8028","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-8028"},"summary":{"title":"CVE-2014-8028","description":"Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco Secure Access Control System (ACS) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq79019.","state":"PUBLISHED","assigner":"cisco","published_at":"2015-01-09 02:59:04","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securitytracker.com/id/1031515","name":"http://www.securitytracker.com/id/1031515","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Cisco Secure Access Control Server Input Validation Flaws Permit Cross-Site Scripting Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8028","name":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8028","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/71946","name":"http://www.securityfocus.com/bid/71946","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Cisco Secure Access Control Server CVE-2014-8028 Multiple Cross Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/62159","name":"http://secunia.com/advisories/62159","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"About Secunia Research | Flexera","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100553","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100553","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8028","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8028","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"8028","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"secure_access_control_system","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T13:10:50.194Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"71946","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/71946"},{"name":"cisco-secureacs-cve20148028-xss(100553)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100553"},{"name":"20150108 Cisco Secure Access Control Server Multiple Cross-Site Scripting Vulnerabilities","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"],"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8028"},{"name":"1031515","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1031515"},{"name":"62159","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/62159"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-01-08T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco Secure Access Control System (ACS) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq79019."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-07T15:57:01.000Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco"},"references":[{"name":"71946","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/71946"},{"name":"cisco-secureacs-cve20148028-xss(100553)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100553"},{"name":"20150108 Cisco Secure Access Control Server Multiple Cross-Site Scripting Vulnerabilities","tags":["vendor-advisory","x_refsource_CISCO"],"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8028"},{"name":"1031515","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1031515"},{"name":"62159","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/62159"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@cisco.com","ID":"CVE-2014-8028","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco Secure Access Control System (ACS) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq79019."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"71946","refsource":"BID","url":"http://www.securityfocus.com/bid/71946"},{"name":"cisco-secureacs-cve20148028-xss(100553)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100553"},{"name":"20150108 Cisco Secure Access Control Server Multiple Cross-Site Scripting Vulnerabilities","refsource":"CISCO","url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8028"},{"name":"1031515","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1031515"},{"name":"62159","refsource":"SECUNIA","url":"http://secunia.com/advisories/62159"}]}}}},"cveMetadata":{"assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","assignerShortName":"cisco","cveId":"CVE-2014-8028","datePublished":"2015-01-09T02:00:00.000Z","dateReserved":"2014-10-08T00:00:00.000Z","dateUpdated":"2024-08-06T13:10:50.194Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-01-09 02:59:04","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:secure_access_control_system:-:*:*:*:*:*:*:*","matchCriteriaId":"716A2EC7-4A03-4BB9-B787-6DD285E25056"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"8028","Ordinal":"1","Title":"CVE-2014-8028","CVE":"CVE-2014-8028","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"8028","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco Secure Access Control System (ACS) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq79019.","Type":"Description","Title":"CVE-2014-8028"},{"CveYear":"2014","CveId":"8028","Ordinal":"2","NoteData":"2015-01-08","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"8028","Ordinal":"3","NoteData":"2017-09-07","Type":"Other","Title":"Modified"}]}}}