CVE-2024-20388

Summary

A vulnerability in the password change feature of Cisco Firepower Management Center (FMC) software could allow an unauthenticated, remote attacker to determine valid user names on an affected device. This vulnerability is due to improper authentication of password update responses. An attacker could exploit this vulnerability by forcing a password reset on an affected device. A successful exploit could allow the attacker to determine valid user names in the unauthenticated response to a forced password reset.

Affected Software

VendorProductVersion RangeStatus
CiscoCisco Firepower Management Center6.2.3affected
CiscoCisco Firepower Management Center6.2.3.1affected
CiscoCisco Firepower Management Center6.2.3.2affected
CiscoCisco Firepower Management Center6.2.3.3affected
CiscoCisco Firepower Management Center6.2.3.4affected
CiscoCisco Firepower Management Center6.2.3.5affected
CiscoCisco Firepower Management Center6.2.3.6affected
CiscoCisco Firepower Management Center6.2.3.7affected
CiscoCisco Firepower Management Center6.2.3.9affected
CiscoCisco Firepower Management Center6.2.3.10affected
CiscoCisco Firepower Management Center6.2.3.11affected
CiscoCisco Firepower Management Center6.2.3.12affected
CiscoCisco Firepower Management Center6.2.3.13affected
CiscoCisco Firepower Management Center6.2.3.14affected
CiscoCisco Firepower Management Center6.2.3.15affected
CiscoCisco Firepower Management Center6.2.3.8affected
CiscoCisco Firepower Management Center6.2.3.16affected
CiscoCisco Firepower Management Center6.2.3.17affected
CiscoCisco Firepower Management Center6.2.3.18affected
CiscoCisco Firepower Management Center6.4.0affected
CiscoCisco Firepower Management Center6.4.0.1affected
CiscoCisco Firepower Management Center6.4.0.3affected
CiscoCisco Firepower Management Center6.4.0.2affected
CiscoCisco Firepower Management Center6.4.0.4affected
CiscoCisco Firepower Management Center6.4.0.5affected
CiscoCisco Firepower Management Center6.4.0.6affected
CiscoCisco Firepower Management Center6.4.0.7affected
CiscoCisco Firepower Management Center6.4.0.8affected
CiscoCisco Firepower Management Center6.4.0.9affected
CiscoCisco Firepower Management Center6.4.0.10affected
CiscoCisco Firepower Management Center6.4.0.11affected
CiscoCisco Firepower Management Center6.4.0.12affected
CiscoCisco Firepower Management Center6.4.0.13affected
CiscoCisco Firepower Management Center6.4.0.14affected
CiscoCisco Firepower Management Center6.4.0.15affected
CiscoCisco Firepower Management Center6.4.0.16affected
CiscoCisco Firepower Management Center6.4.0.17affected
CiscoCisco Firepower Management Center6.4.0.18affected
CiscoCisco Firepower Management Center6.6.0affected
CiscoCisco Firepower Management Center6.6.0.1affected
CiscoCisco Firepower Management Center6.6.1affected
CiscoCisco Firepower Management Center6.6.3affected
CiscoCisco Firepower Management Center6.6.4affected
CiscoCisco Firepower Management Center6.6.5affected
CiscoCisco Firepower Management Center6.6.5.1affected
CiscoCisco Firepower Management Center6.6.5.2affected
CiscoCisco Firepower Management Center6.6.7affected
CiscoCisco Firepower Management Center6.6.7.1affected
CiscoCisco Firepower Management Center6.6.7.2affected
CiscoCisco Firepower Management Center6.7.0affected
CiscoCisco Firepower Management Center6.7.0.1affected
CiscoCisco Firepower Management Center6.7.0.2affected
CiscoCisco Firepower Management Center6.7.0.3affected
CiscoCisco Firepower Management Center7.0.0affected
CiscoCisco Firepower Management Center7.0.0.1affected
CiscoCisco Firepower Management Center7.0.1affected
CiscoCisco Firepower Management Center7.0.1.1affected
CiscoCisco Firepower Management Center7.0.2affected
CiscoCisco Firepower Management Center7.0.2.1affected
CiscoCisco Firepower Management Center7.0.3affected
CiscoCisco Firepower Management Center7.0.4affected
CiscoCisco Firepower Management Center7.0.5affected
CiscoCisco Firepower Management Center7.0.6affected
CiscoCisco Firepower Management Center7.0.6.1affected
CiscoCisco Firepower Management Center7.0.6.2affected
CiscoCisco Firepower Management Center7.1.0affected
CiscoCisco Firepower Management Center7.1.0.1affected
CiscoCisco Firepower Management Center7.1.0.2affected
CiscoCisco Firepower Management Center7.1.0.3affected
CiscoCisco Firepower Management Center7.2.0affected
CiscoCisco Firepower Management Center7.2.1affected
CiscoCisco Firepower Management Center7.2.2affected
CiscoCisco Firepower Management Center7.2.0.1affected
CiscoCisco Firepower Management Center7.2.3affected
CiscoCisco Firepower Management Center7.2.3.1affected
CiscoCisco Firepower Management Center7.2.4affected
CiscoCisco Firepower Management Center7.2.4.1affected
CiscoCisco Firepower Management Center7.2.5affected
CiscoCisco Firepower Management Center7.2.5.1affected
CiscoCisco Firepower Management Center7.2.6affected
CiscoCisco Firepower Management Center7.2.7affected
CiscoCisco Firepower Management Center7.2.5.2affected
CiscoCisco Firepower Management Center7.2.8affected
CiscoCisco Firepower Management Center7.2.8.1affected
CiscoCisco Firepower Management Center7.3.0affected
CiscoCisco Firepower Management Center7.3.1affected
CiscoCisco Firepower Management Center7.3.1.1affected
CiscoCisco Firepower Management Center7.3.1.2affected
CiscoCisco Firepower Management Center7.4.0affected
CiscoCisco Firepower Management Center7.4.1affected
CiscoCisco Firepower Management Center7.4.1.1affected
CiscoCisco Firepower Threat Defense Software6.6.5.1affected
CiscoCisco Firepower Threat Defense Software6.6.7affected
CiscoCisco Firepower Threat Defense Software6.4.0.4affected
CiscoCisco Firepower Threat Defense Software6.4.0.10affected
CiscoCisco Firepower Threat Defense Software6.4.0.12affected
CiscoCisco Firepower Threat Defense Software6.4.0.14affected
CiscoCisco Firepower Threat Defense Software6.4.0.16affected
CiscoCisco Firepower Threat Defense Software6.4.0.18affected
CiscoCisco Firepower Threat Defense Software6.7.0.2affected
CiscoCisco Firepower Threat Defense Software7.1.0.1affected
CiscoCisco Firepower Threat Defense Software7.1.0.3affected
CiscoCisco Firepower Threat Defense Software7.2.2affected
CiscoCisco Firepower Threat Defense Software7.4.1affected

Weaknesses

  • CWE-202: Exposure of Sensitive Information Through Data Queries

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References