CVE-2024-20504

Summary

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface.

This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Affected Software

VendorProductVersion RangeStatus
CiscoCisco Secure Email14.0.0-698affected
CiscoCisco Secure Email14.2.0-620affected
CiscoCisco Secure Email14.2.1-020affected
CiscoCisco Secure Email14.3.0-032affected
CiscoCisco Secure Email15.0.0-104affected
CiscoCisco Secure Email15.0.1-030affected
CiscoCisco Secure Email15.5.0-048affected
CiscoCisco Secure Email15.5.1-055affected
CiscoCisco Secure Email and Web Manager14.0.0-404affected
CiscoCisco Secure Email and Web Manager14.1.0-223affected
CiscoCisco Secure Email and Web Manager14.1.0-227affected
CiscoCisco Secure Email and Web Manager14.2.0-212affected
CiscoCisco Secure Email and Web Manager14.2.0-224affected
CiscoCisco Secure Email and Web Manager14.2.1-020affected
CiscoCisco Secure Email and Web Manager14.3.0-120affected
CiscoCisco Secure Email and Web Manager15.0.0-334affected
CiscoCisco Secure Email and Web Manager15.5.1-024affected
CiscoCisco Secure Email and Web Manager15.5.1-029affected
CiscoCisco Secure Web Appliance14.1.0-032affected
CiscoCisco Secure Web Appliance14.1.0-047affected
CiscoCisco Secure Web Appliance14.1.0-041affected
CiscoCisco Secure Web Appliance14.0.2-012affected
CiscoCisco Secure Web Appliance14.5.0-498affected
CiscoCisco Secure Web Appliance14.0.3-014affected
CiscoCisco Secure Web Appliance14.0.4-005affected
CiscoCisco Secure Web Appliance14.5.1-008affected
CiscoCisco Secure Web Appliance14.5.1-016affected
CiscoCisco Secure Web Appliance15.0.0-355affected
CiscoCisco Secure Web Appliance15.0.0-322affected
CiscoCisco Secure Web Appliance15.1.0-287affected
CiscoCisco Secure Web Appliance14.5.2-011affected
CiscoCisco Secure Web Appliance15.2.0-116affected
CiscoCisco Secure Web Appliance14.0.5-007affected
CiscoCisco Secure Web Appliance15.2.0-164affected
CiscoCisco Secure Web Appliance14.5.1-510affected
CiscoCisco Secure Web Appliance14.5.1-607affected
CiscoCisco Secure Web Appliance14.5.3-033affected

Weaknesses

  • CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References