CVE-2024-20258

State: Published
Severity: 6.1 Medium
Published: May 15, 2024
Updated: Aug 1, 2024
Reserved: Nov 8, 2023

Description

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	cisco

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
Cisco Secure EmailCisco	11.0.3-238Affected 11.1.0-069Affected 11.1.0-131Affected 11.1.0-128Affected 12.0.0-419Affected 12.1.0-071Affected 12.1.0-087Affected 12.1.0-089Affected 13.0.0-392Affected 13.0.5-007Affected 13.5.1-277Affected 13.5.4-038Affected 12.5.0-066Affected 12.5.4-041Affected 12.5.3-041Affected 14.0.0-698Affected 14.2.0-620Affected 14.2.1-020Affected 14.3.0-032Affected 15.0.0-104Affected 15.0.1-030Affected 15.5.0-048Affected
Cisco Secure Email and Web ManagerCisco	9.0.0-087Affected 11.0.0-115Affected 11.0.1-161Affected 11.5.1-105Affected 12.0.0-452Affected 12.0.1-011Affected 12.5.0-636Affected 12.5.0-658Affected 12.5.0-678Affected 12.5.0-670Affected 13.0.0-277Affected 13.6.2-078Affected 13.8.1-068Affected 13.8.1-074Affected 13.8.1-108Affected 12.8.1-002Affected 12.8.1-021Affected 14.0.0-404Affected 14.1.0-223Affected 14.1.0-227Affected 14.2.0-212Affected 14.2.0-224Affected 14.2.1-020Affected 14.3.0-120Affected 15.0.0-334Affected

Product

Versions

Cisco Secure EmailCisco

11.0.3-238Affected
11.1.0-069Affected
11.1.0-131Affected
11.1.0-128Affected
12.0.0-419Affected
12.1.0-071Affected
12.1.0-087Affected
12.1.0-089Affected
13.0.0-392Affected
13.0.5-007Affected
13.5.1-277Affected
13.5.4-038Affected
12.5.0-066Affected
12.5.4-041Affected
12.5.3-041Affected
14.0.0-698Affected
14.2.0-620Affected
14.2.1-020Affected
14.3.0-032Affected
15.0.0-104Affected
15.0.1-030Affected
15.5.0-048Affected

Cisco Secure Email and Web ManagerCisco

9.0.0-087Affected
11.0.0-115Affected
11.0.1-161Affected
11.5.1-105Affected
12.0.0-452Affected
12.0.1-011Affected
12.5.0-636Affected
12.5.0-658Affected
12.5.0-678Affected
12.5.0-670Affected
13.0.0-277Affected
13.6.2-078Affected
13.8.1-068Affected
13.8.1-074Affected
13.8.1-108Affected
12.8.1-002Affected
12.8.1-021Affected
14.0.0-404Affected
14.1.0-223Affected
14.1.0-227Affected
14.2.0-212Affected
14.2.0-224Affected
14.2.1-020Affected
14.3.0-120Affected
15.0.0-334Affected

References

cisco-sa-esa-sma-wsa-xss-bgG5WHOD

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.