4.8

CVE-2024-20256

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Web Appliance could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface.

This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Asyncos Version 11.7.0-406
Cisco ≫ Asyncos Version 11.7.0-418
Cisco ≫ Asyncos Version 11.7.1-006
Cisco ≫ Asyncos Version 11.7.1-020
Cisco ≫ Asyncos Version 11.7.1-049
Cisco ≫ Asyncos Version 11.7.2-011
Cisco ≫ Asyncos Version 11.8.0-414
Cisco ≫ Asyncos Version 11.8.1-023
Cisco ≫ Asyncos Version 11.8.3-018
Cisco ≫ Asyncos Version 11.8.3-021
Cisco ≫ Asyncos Version 12.0.1-268
Cisco ≫ Asyncos Version 12.0.3-007
Cisco ≫ Asyncos Version 12.5.1-011
Cisco ≫ Asyncos Version 12.5.2-007
Cisco ≫ Asyncos Version 12.5.4-005
Cisco ≫ Asyncos Version 12.5.5-004
Cisco ≫ Asyncos Version 12.5.6-008
Cisco ≫ Asyncos Version 14.0.2-012
Cisco ≫ Asyncos Version 14.0.3-014
Cisco ≫ Asyncos Version 14.0.4-005
Cisco ≫ Asyncos Version 14.5.0-498
Cisco ≫ Asyncos Version 14.5.1-016
Cisco ≫ Asyncos Version 15.0.0-322
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.29% 0.209
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Cisco PSIRT 4.8 1.7 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-xss-bgG5WHOD
Vendor Advisory