CVE-2024-20256

State: Published
Severity: 4.8 Medium
Published: May 15, 2024
Updated: Aug 15, 2024
Reserved: Nov 8, 2023

Description

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Web Appliance could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Scores

CVSS	Score	Vector	Source
3.1	4.8 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	cisco

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
Cisco Secure Web ApplianceCisco	11.7.0-406Affected 11.7.0-418Affected 11.7.1-049Affected 11.7.1-006Affected 11.7.1-020Affected 11.7.2-011Affected 11.8.0-414Affected 11.8.1-023Affected 11.8.3-018Affected 11.8.3-021Affected 12.0.1-268Affected 12.0.3-007Affected 12.5.2-007Affected 12.5.1-011Affected 12.5.4-005Affected 12.5.5-004Affected 12.5.6-008Affected 14.5.0-498Affected 14.5.1-016Affected 14.0.3-014Affected 14.0.2-012Affected 14.0.4-005Affected 15.0.0-322Affected
Cisco Secure Email and Web ManagerCisco	9.0.0-087Affected 11.0.0-115Affected 11.0.1-161Affected 11.5.1-105Affected 12.0.0-452Affected 12.0.1-011Affected 12.5.0-636Affected 12.5.0-658Affected 12.5.0-678Affected 12.5.0-670Affected 13.0.0-277Affected 13.6.2-078Affected 13.8.1-068Affected 13.8.1-074Affected 13.8.1-108Affected 12.8.1-002Affected 12.8.1-021Affected 14.0.0-404Affected 14.1.0-223Affected 14.1.0-227Affected 14.2.0-212Affected 14.2.0-224Affected 14.2.1-020Affected 14.3.0-120Affected 15.0.0-334Affected

Product

Versions

Cisco Secure Web ApplianceCisco

11.7.0-406Affected
11.7.0-418Affected
11.7.1-049Affected
11.7.1-006Affected
11.7.1-020Affected
11.7.2-011Affected
11.8.0-414Affected
11.8.1-023Affected
11.8.3-018Affected
11.8.3-021Affected
12.0.1-268Affected
12.0.3-007Affected
12.5.2-007Affected
12.5.1-011Affected
12.5.4-005Affected
12.5.5-004Affected
12.5.6-008Affected
14.5.0-498Affected
14.5.1-016Affected
14.0.3-014Affected
14.0.2-012Affected
14.0.4-005Affected
15.0.0-322Affected

Cisco Secure Email and Web ManagerCisco

9.0.0-087Affected
11.0.0-115Affected
11.0.1-161Affected
11.5.1-105Affected
12.0.0-452Affected
12.0.1-011Affected
12.5.0-636Affected
12.5.0-658Affected
12.5.0-678Affected
12.5.0-670Affected
13.0.0-277Affected
13.6.2-078Affected
13.8.1-068Affected
13.8.1-074Affected
13.8.1-108Affected
12.8.1-002Affected
12.8.1-021Affected
14.0.0-404Affected
14.1.0-223Affected
14.1.0-227Affected
14.2.0-212Affected
14.2.0-224Affected
14.2.1-020Affected
14.3.0-120Affected
15.0.0-334Affected

References

cisco-sa-esa-sma-wsa-xss-bgG5WHOD

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.