CVE-2024-20504

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-wsa-sma-xss-zYm3f49n	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:cisco:asyncos:14.0.0-698:::::::*
	cpe:2.3:o:cisco:asyncos:14.2.0-620:::::::*
	cpe:2.3:o:cisco:asyncos:14.2.1-020:::::::*
	cpe:2.3:o:cisco:asyncos:14.3.0-032:::::::*
	cpe:2.3:o:cisco:asyncos:15.0.0-104:::::::*
	cpe:2.3:o:cisco:asyncos:15.0.1-030:::::::*
	cpe:2.3:o:cisco:asyncos:15.5.0-048:::::::*
	cpe:2.3:o:cisco:asyncos:15.5.1-055:::::::*

OR	cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c100v:-:::::::*
	cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c300v:-:::::::*
	cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c600v:-:::::::*
	cpe:2.3:h:cisco:secure_email_gateway_c195:-:::::::*
	cpe:2.3:h:cisco:secure_email_gateway_c395:-:::::::*
	cpe:2.3:h:cisco:secure_email_gateway_c695:-:::::::*

Configuration 2 (hide)

AND

OR	cpe:2.3:o:cisco:asyncos:14.0.0-404:::::::*
	cpe:2.3:o:cisco:asyncos:14.1.0-223:::::::*
	cpe:2.3:o:cisco:asyncos:14.1.0-227:::::::*
	cpe:2.3:o:cisco:asyncos:14.2.0-212:::::::*
	cpe:2.3:o:cisco:asyncos:14.2.0-224:::::::*
	cpe:2.3:o:cisco:asyncos:14.2.1-020:::::::*
	cpe:2.3:o:cisco:asyncos:14.3.0-120:::::::*
	cpe:2.3:o:cisco:asyncos:15.0.0-334:::::::*
	cpe:2.3:o:cisco:asyncos:15.5.1-024:::::::*
	cpe:2.3:o:cisco:asyncos:15.5.1-029:::::::*

OR	cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m100v:-:::::::*
	cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m300v:-:::::::*
	cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m600v:-:::::::*
	cpe:2.3:h:cisco:secure_email_and_web_manager_m170:-:::::::*
	cpe:2.3:h:cisco:secure_email_and_web_manager_m190:-:::::::*
	cpe:2.3:h:cisco:secure_email_and_web_manager_m195:-:::::::*
	cpe:2.3:h:cisco:secure_email_and_web_manager_m380:-:::::::*
	cpe:2.3:h:cisco:secure_email_and_web_manager_m390:-:::::::*
	cpe:2.3:h:cisco:secure_email_and_web_manager_m390x:-:::::::*
	cpe:2.3:h:cisco:secure_email_and_web_manager_m395:-:::::::*
	cpe:2.3:h:cisco:secure_email_and_web_manager_m680:-:::::::*
	cpe:2.3:h:cisco:secure_email_and_web_manager_m690:-:::::::*
	cpe:2.3:h:cisco:secure_email_and_web_manager_m690x:-:::::::*
	cpe:2.3:h:cisco:secure_email_and_web_manager_m695:-:::::::*

Configuration 3 (hide)

AND

OR	cpe:2.3:o:cisco:asyncos:14.0.2-012:::::::*
	cpe:2.3:o:cisco:asyncos:14.0.3-014:::::::*
	cpe:2.3:o:cisco:asyncos:14.0.4-005:::::::*
	cpe:2.3:o:cisco:asyncos:14.0.5-007:::::::*
	cpe:2.3:o:cisco:asyncos:14.1.0-032:::::::*
	cpe:2.3:o:cisco:asyncos:14.1.0-041:::::::*
	cpe:2.3:o:cisco:asyncos:14.1.0-047:::::::*
	cpe:2.3:o:cisco:asyncos:14.5.0-498:::::::*
	cpe:2.3:o:cisco:asyncos:14.5.1-008:::::::*
	cpe:2.3:o:cisco:asyncos:14.5.1-016:::::::*
	cpe:2.3:o:cisco:asyncos:14.5.1-510:::::::*
	cpe:2.3:o:cisco:asyncos:14.5.1-607:::::::*
	cpe:2.3:o:cisco:asyncos:14.5.2-011:::::::*
	cpe:2.3:o:cisco:asyncos:14.5.3-033:::::::*
	cpe:2.3:o:cisco:asyncos:15.0.0-322:::::::*
	cpe:2.3:o:cisco:asyncos:15.0.0-355:::::::*
	cpe:2.3:o:cisco:asyncos:15.1.0-287:::::::*
	cpe:2.3:o:cisco:asyncos:15.2.0-116:::::::*
	cpe:2.3:o:cisco:asyncos:15.2.0-164:::::::*

OR	cpe:2.3:a:cisco:secure_web_appliance_virtual_s1000v:-:::::::*
	cpe:2.3:a:cisco:secure_web_appliance_virtual_s100v:-:::::::*
	cpe:2.3:a:cisco:secure_web_appliance_virtual_s300v:-:::::::*
	cpe:2.3:a:cisco:secure_web_appliance_virtual_s600v:-:::::::*
	cpe:2.3:h:cisco:secure_web_appliance_s196:-:::::::*
	cpe:2.3:h:cisco:secure_web_appliance_s396:-:::::::*
	cpe:2.3:h:cisco:secure_web_appliance_s696:-:::::::*

History

No history.

Information

Published : 2024-11-06 17:15

Updated : 2025-08-07 19:08

NVD link : CVE-2024-20504

Mitre link : CVE-2024-20504

CVE.ORG link : CVE-2024-20504

JSON object : View

Products Affected

cisco

secure_web_appliance_s396
secure_email_gateway_virtual_appliance_c100v
secure_email_gateway_virtual_appliance_c300v
secure_email_and_web_manager_m695
secure_web_appliance_virtual_s100v
asyncos
secure_email_and_web_manager_m390
secure_email_and_web_manager_virtual_appliance_m100v
secure_web_appliance_virtual_s1000v
secure_email_and_web_manager_m190
secure_web_appliance_virtual_s600v
secure_email_gateway_c695
secure_email_and_web_manager_m380
secure_email_and_web_manager_m195
secure_email_and_web_manager_m395
secure_email_and_web_manager_m680
secure_web_appliance_s196
secure_email_gateway_c195
secure_email_and_web_manager_m170
secure_email_and_web_manager_m390x
secure_email_and_web_manager_m690x
secure_email_gateway_virtual_appliance_c600v
secure_web_appliance_virtual_s300v
secure_email_and_web_manager_virtual_appliance_m300v
secure_web_appliance_s696
secure_email_gateway_c395
secure_email_and_web_manager_m690
secure_email_and_web_manager_virtual_appliance_m600v

CWE

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

5.4 /10