The Cisco ASA VPN Portal password recovery page suffers from a cross site scripting vulnerability.