CVE:CVE-2008-0533
CNNVD:CNNVD-200803-227
UCP应用允许终端用户使用基于Web的工具更改Cisco Secure Access Control Server(ACS)的口令。
/securecgi-bin/CSUserCGI.exe CGI存在多个缓冲区溢出和跨站脚本漏洞，远程攻击者可能利用一个本地HELP参数后的直接参数注入任意WEB脚本和HTML代码.也有可能是其他未知向量
solution:Upgrade cisco acs_for_windows to a higher version than *; Upgrade cisco acs_solution_engine to a higher version than *; Upgrade cisco user_changeable_password to a higher version than 4.1,and avoid the version 4.1