6.1

CVE-2026-20102

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software SAML Reflected Cross-Site Scripting Vulnerability

A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the SAML feature and access sensitive, browser-based information.

This vulnerability is due to insufficient input validation of multiple HTTP parameters. An attacker could exploit this vulnerability by persuading a user to access a malicious link. A successful exploit could allow the attacker to conduct a reflected XSS attack through an affected device.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Adaptive Security Appliance Software Version >= 9.16.1 < 9.16.4.89
Cisco ≫ Adaptive Security Appliance Software Version >= 9.17.1 < 9.18.4.71
Cisco ≫ Adaptive Security Appliance Software Version >= 9.20.1 < 9.20.4.19
Cisco ≫ Adaptive Security Appliance Software Version >= 9.22.1.1 < 9.22.2.32
Cisco ≫ Adaptive Security Appliance Software Version >= 9.23.1 < 9.23.1.26
Cisco ≫ Firepower Threat Defense Software Version >= 7.0.0 < 7.0.9
Cisco ≫ Firepower Threat Defense Software Version >= 7.1.0 < 7.2.11
Cisco ≫ Firepower Threat Defense Software Version >= 7.4.0 < 7.4.3
Cisco ≫ Firepower Threat Defense Software Version >= 7.6.0 < 10.0.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.01% 0.012
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
psirt@cisco.com 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.