CVE-2024-20258

Description

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Reserved 2023-11-08 | Published 2024-05-15 | Updated 2024-08-01 | Assigner cisco

Problem types

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

11.0.3-238
affected

11.1.0-069
affected

11.1.0-131
affected

11.1.0-128
affected

12.0.0-419
affected

12.1.0-071
affected

12.1.0-087
affected

12.1.0-089
affected

13.0.0-392
affected

13.0.5-007
affected

13.5.1-277
affected

13.5.4-038
affected

12.5.0-066
affected

12.5.4-041
affected

12.5.3-041
affected

14.0.0-698
affected

14.2.0-620
affected

14.2.1-020
affected

14.3.0-032
affected

15.0.0-104
affected

15.0.1-030
affected

15.5.0-048
affected

9.0.0-087
affected

11.0.0-115
affected

11.0.1-161
affected

11.5.1-105
affected

12.0.0-452
affected

12.0.1-011
affected

12.5.0-636
affected

12.5.0-658
affected

12.5.0-678
affected

12.5.0-670
affected

13.0.0-277
affected

13.6.2-078
affected

13.8.1-068
affected

13.8.1-074
affected

13.8.1-108
affected

12.8.1-002
affected

12.8.1-021
affected

14.0.0-404
affected

14.1.0-223
affected

14.1.0-227
affected

14.2.0-212
affected

14.2.0-224
affected

14.2.1-020
affected

14.3.0-120
affected

15.0.0-334
affected

References

sec.cloudapps.cisco.com/...cisco-sa-esa-sma-wsa-xss-bgG5WHOD (cisco-sa-esa-sma-wsa-xss-bgG5WHOD)

cve.org (CVE-2024-20258)

nvd.nist.gov (CVE-2024-20258)

Download JSON