A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

According to its self-reported version, Secure Web Appliance is affected by a vulnerability.

  - A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and     Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker     to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability     is due to insufficient validation of user input. An attacker could exploit this vulnerability by     persuading a user of an affected interface to click a crafted link. A successful exploit could allow the     attacker to execute arbitrary script code in the context of the affected interface or access sensitive,     browser-based information. (CVE-2024-20504)

Please see the included Cisco BID and Cisco Security Advisory for more information.

According to its self-reported version, Secure Email Gateway is affected by a vulnerability.

  - A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and     Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker     to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability     is due to insufficient validation of user input. An attacker could exploit this vulnerability by     persuading a user of an affected interface to click a crafted link. A successful exploit could allow the     attacker to execute arbitrary script code in the context of the affected interface or access sensitive,     browser-based information. (CVE-2024-20504)

Please see the included Cisco BID and Cisco Security Advisory for more information.

According to its self-reported version, Cisco Secure Email and Web Manager is affected by a vulnerability.

  - A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and     Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker     to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability     is due to insufficient validation of user input. An attacker could exploit this vulnerability by     persuading a user of an affected interface to click a crafted link. A successful exploit could allow the     attacker to execute arbitrary script code in the context of the affected interface or access sensitive,     browser-based information. (CVE-2024-20504)

Please see the included Cisco BID and Cisco Security Advisory for more information.

ID	Name	Product	Family	Severity
210599	Secure Web Appliance XSS (cisco-sa-esa-wsa-sma-xss-zYm3f49n)	Nessus	CISCO	medium
210598	Secure Email Gateway XSS (cisco-sa-esa-wsa-sma-xss-zYm3f49n)	Nessus	CISCO	medium
210597	Cisco Secure Email and Web Manager XSS (cisco-sa-esa-wsa-sma-xss-zYm3f49n)	Nessus	CISCO	medium

Detections

Analytics

CVE-2024-20504

medium

Tenable Plugins

medium

medium

medium