Vulnerability Description
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Asyncos | < 15.5.1-024 |
| Cisco | Secure Email And Web Manager Virtual Appliance M100V | - |
| Cisco | Secure Email And Web Manager Virtual Appliance M300V | - |
| Cisco | Secure Email And Web Manager Virtual Appliance M600V | - |
| Cisco | Secure Email And Web Manager M170 | - |
| Cisco | Secure Email And Web Manager M190 | - |
| Cisco | Secure Email And Web Manager M195 | - |
| Cisco | Secure Email And Web Manager M380 | - |
| Cisco | Secure Email And Web Manager M390 | - |
| Cisco | Secure Email And Web Manager M390X | - |
| Cisco | Secure Email And Web Manager M395 | - |
| Cisco | Secure Email And Web Manager M680 | - |
| Cisco | Secure Email And Web Manager M690 | - |
| Cisco | Secure Email And Web Manager M690X | - |
| Cisco | Secure Email And Web Manager M695 | - |
Related Weaknesses (CWE)
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/ciVendor Advisory
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/ciVendor Advisory
FAQ
What is CVE-2024-20383?
CVE-2024-20383 is a vulnerability with a CVSS score of 4.8 (MEDIUM). A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager could allow an authenticated, remote attacker to conduct an XSS attack against a ...
How severe is CVE-2024-20383?
CVE-2024-20383 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-20383?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Asyncos, Cisco Secure Email And Web Manager Virtual Appliance M100V, Cisco Secure Email And Web Manager Virtual Appliance M300V, Cisco Secure Email And Web Manager Virtual Appliance M600V, Cisco Secure Email And Web Manager M170.