CVE-2024-20337

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF) injection attack against a user. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link while establishing a VPN session. A successful exploit could allow the attacker to execute arbitrary script code in the browser or access sensitive, browser-based information, including a valid SAML token. The attacker could then use the token to establish a remote access VPN session with the privileges of the affected user. Individual hosts and services behind the VPN headend would still need additional credentials for successful access.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-93

Affected software

VendorProductVersions
CiscoCisco Secure Client4.9.00086; 4.9.01095; 4.9.02028; 4.9.03047; 4.9.03049; 4.9.04043; 4.9.04053; 4.9.05042; 4.9.06037; 4.10.00093; 4.10.01075; 4.10.02086; 4.10.03104; 4.10.04065; 4.10.04071; 4.10.05085; 4.10.05095; 4.10.05111; 4.10.06079; 4.10.06090
ciscosecure_client4.10.00093; 4.10.01075; 4.10.02086; 4.10.03104; 4.10.04065; 4.10.04071; 4.10.05085; 4.10.05095; 4.10.05111; 4.10.06079; 4.10.06090; 4.10.07061; 4.10.07062; 4.10.07073; 4.9.00086; 4.9.01095; 4.9.02028; 4.9.03047; 4.9.03049; 4.9.04043

References

Timeline

Published
Mar 6, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-203387.3A vulnerability in the ISE Posture (System Scan) module of Cisco Secure Client for Linux could allow an authenticated, local attacker to eleCVE-2024-203397.5A vulnerability in the TLS processing feature of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series could allow aCVE-2024-203406.5A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower ManagemeCVE-2024-203416.1A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefensCVE-2024-203428.6Multiple Cisco products are affected by a vulnerability in the rate filtering feature of the Snort detection engine that could allow an unauCVE-2024-203435.5A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to read any file in the file system of the CVE-2024-203445.3A vulnerability in system resource management in Cisco UCS 6400 and 6500 Series Fabric Interconnects that are in Intersight Managed Mode (IMCVE-2024-203456.5A vulnerability in the file upload functionality of Cisco AppDynamics Controller could allow an authenticated, remote attacker to conduct diCVE-2024-203465.4A vulnerability in the web-based management interface of Cisco AppDynamics Controller could allow an authenticated, remote attacker to perfoCVE-2024-203476.5A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a CSRF attack, which could allow theCVE-2024-203487.5A vulnerability in the Out-of-Band (OOB) Plug and Play (PnP) feature of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthCVE-2024-20356.5An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint.
CVE-2024-20337: High severity, CVSS 8.2 | Vulnix