CVE-2024-20387

Summary

A vulnerability in the web-based management interface of Cisco FMC Software could allow an authenticated, remote attacker to store malicious content for use in XSS attacks. This vulnerability is due to improper input sanitization in the web-based management interface of Cisco FMC Software. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to conduct a stored XSS attack on an affected device.

Affected Software

VendorProductVersion RangeStatus
CiscoCisco Firepower Management Center6.2.3.17affected
CiscoCisco Firepower Management Center6.2.3.18affected
CiscoCisco Firepower Management Center6.4.0.13affected
CiscoCisco Firepower Management Center6.4.0.14affected
CiscoCisco Firepower Management Center6.4.0.15affected
CiscoCisco Firepower Management Center6.4.0.16affected
CiscoCisco Firepower Management Center6.4.0.17affected
CiscoCisco Firepower Management Center6.4.0.18affected
CiscoCisco Firepower Management Center6.6.0affected
CiscoCisco Firepower Management Center6.6.0.1affected
CiscoCisco Firepower Management Center6.6.1affected
CiscoCisco Firepower Management Center6.6.3affected
CiscoCisco Firepower Management Center6.6.4affected
CiscoCisco Firepower Management Center6.6.5affected
CiscoCisco Firepower Management Center6.6.5.1affected
CiscoCisco Firepower Management Center6.6.5.2affected
CiscoCisco Firepower Management Center6.6.7affected
CiscoCisco Firepower Management Center6.6.7.1affected
CiscoCisco Firepower Management Center6.6.7.2affected
CiscoCisco Firepower Management Center7.0.6affected
CiscoCisco Firepower Management Center7.0.6.1affected
CiscoCisco Firepower Management Center7.0.6.2affected
CiscoCisco Firepower Management Center7.2.4affected
CiscoCisco Firepower Management Center7.2.4.1affected
CiscoCisco Firepower Management Center7.2.5affected
CiscoCisco Firepower Management Center7.2.5.1affected
CiscoCisco Firepower Management Center7.2.6affected
CiscoCisco Firepower Management Center7.2.7affected
CiscoCisco Firepower Management Center7.2.5.2affected
CiscoCisco Firepower Management Center7.2.8affected
CiscoCisco Firepower Management Center7.2.8.1affected
CiscoCisco Firepower Management Center7.3.0affected
CiscoCisco Firepower Management Center7.3.1affected
CiscoCisco Firepower Management Center7.3.1.1affected
CiscoCisco Firepower Management Center7.3.1.2affected
CiscoCisco Firepower Management Center7.4.0affected
CiscoCisco Firepower Management Center7.4.1affected
CiscoCisco Firepower Management Center7.4.1.1affected

Weaknesses

  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References