Riskcovery

CVE-2024-20504

Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Stored Cross-Site Scripting Vulnerabilities

State
Published
Severity
5.4 Medium
Published
Nov 6, 2024
Updated
Nov 6, 2024
Reserved
Nov 8, 2023

Read the record on cve.org

Description

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface.

This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Scores

CVSSScoreVectorSource
3.15.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Ncisco

Weaknesses

  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Affected Products

ProductVersions
Cisco Secure EmailCisco
  • 14.0.0-698Affected
  • 14.2.0-620Affected
  • 14.2.1-020Affected
  • 14.3.0-032Affected
  • 15.0.0-104Affected
  • 15.0.1-030Affected
  • 15.5.0-048Affected
  • 15.5.1-055Affected
Cisco Secure Email and Web ManagerCisco
  • 14.0.0-404Affected
  • 14.1.0-223Affected
  • 14.1.0-227Affected
  • 14.2.0-212Affected
  • 14.2.0-224Affected
  • 14.2.1-020Affected
  • 14.3.0-120Affected
  • 15.0.0-334Affected
  • 15.5.1-024Affected
  • 15.5.1-029Affected
Cisco Secure Web ApplianceCisco
  • 14.1.0-032Affected
  • 14.1.0-047Affected
  • 14.1.0-041Affected
  • 14.0.2-012Affected
  • 14.5.0-498Affected
  • 14.0.3-014Affected
  • 14.0.4-005Affected
  • 14.5.1-008Affected
  • 14.5.1-016Affected
  • 15.0.0-355Affected
  • 15.0.0-322Affected
  • 15.1.0-287Affected
  • 14.5.2-011Affected
  • 15.2.0-116Affected
  • 14.0.5-007Affected
  • 15.2.0-164Affected
  • 14.5.1-510Affected
  • 14.5.1-607Affected
  • 14.5.3-033Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.