CVE-2024-20504

EPSS 0.08%
Published 06.11.2024 17:15:16
Last modified 07.08.2025 19:08:29
Source psirt@cisco.com
Teams watchlist Login
Open Login

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface.

This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Affected products Warnungen 0 Metrics 2 CWE 1 References 4

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD

This information is available to logged-in users.

Data is provided by the National Vulnerability Database (NVD)

Cisco ≫ Asyncos Version14.0.0-698

   Cisco ≫ Secure Email Gateway Virtual Appliance C100v Version-
   Cisco ≫ Secure Email Gateway Virtual Appliance C300v Version-
   Cisco ≫ Secure Email Gateway Virtual Appliance C600v Version-
   Cisco ≫ Secure Email Gateway C195 Version-
   Cisco ≫ Secure Email Gateway C395 Version-
   Cisco ≫ Secure Email Gateway C695 Version-

Cisco ≫ Asyncos Version14.2.0-620

Cisco ≫ Asyncos Version14.2.1-020

Cisco ≫ Asyncos Version14.3.0-032

Cisco ≫ Asyncos Version15.0.0-104

Cisco ≫ Asyncos Version15.0.1-030

Cisco ≫ Asyncos Version15.5.0-048

Cisco ≫ Asyncos Version15.5.1-055

Cisco ≫ Asyncos Version14.0.0-404

Cisco ≫ Asyncos Version14.1.0-223

Cisco ≫ Asyncos Version14.1.0-227

Cisco ≫ Asyncos Version14.2.0-212

Cisco ≫ Asyncos Version14.2.0-224

Cisco ≫ Asyncos Version14.2.1-020

Cisco ≫ Asyncos Version14.3.0-120

Cisco ≫ Asyncos Version15.0.0-334

Cisco ≫ Asyncos Version15.5.1-024

Cisco ≫ Asyncos Version15.5.1-029

Cisco ≫ Asyncos Version14.0.2-012

   Cisco ≫ Secure Web Appliance Virtual S1000v Version-
   Cisco ≫ Secure Web Appliance Virtual S100v Version-
   Cisco ≫ Secure Web Appliance Virtual S300v Version-
   Cisco ≫ Secure Web Appliance Virtual S600v Version-
   Cisco ≫ Secure Web Appliance S196 Version-
   Cisco ≫ Secure Web Appliance S396 Version-
   Cisco ≫ Secure Web Appliance S696 Version-

Cisco ≫ Asyncos Version14.0.3-014

Cisco ≫ Asyncos Version14.0.4-005

Cisco ≫ Asyncos Version14.0.5-007

Cisco ≫ Asyncos Version14.1.0-032

Cisco ≫ Asyncos Version14.1.0-041

Cisco ≫ Asyncos Version14.1.0-047

Cisco ≫ Asyncos Version14.5.0-498

Cisco ≫ Asyncos Version14.5.1-008

Cisco ≫ Asyncos Version14.5.1-016

Cisco ≫ Asyncos Version14.5.1-510

Cisco ≫ Asyncos Version14.5.1-607

Cisco ≫ Asyncos Version14.5.2-011

Cisco ≫ Asyncos Version14.5.3-033

Cisco ≫ Asyncos Version15.0.0-322

Cisco ≫ Asyncos Version15.0.0-355

Cisco ≫ Asyncos Version15.1.0-287

Cisco ≫ Asyncos Version15.2.0-116

Cisco ≫ Asyncos Version15.2.0-164

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.08%	0.239

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
psirt@cisco.com	5.4	2.3	2.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-wsa-sma-xss-zYm3f49n

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2024-20504

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-20504

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-20504

EUVD