CVE-2024-20387

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based management interface of Cisco FMC Software could allow an authenticated, remote attacker to store malicious content for use in XSS attacks. This vulnerability is due to improper input sanitization in the web-based management interface of Cisco FMC Software. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to conduct a stored XSS attack on an affected device.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
CiscoCisco Firepower Management Center6.2.3.17; 6.2.3.18; 6.4.0.13; 6.4.0.14; 6.4.0.15; 6.4.0.16; 6.4.0.17; 6.4.0.18; 6.6.0; 6.6.0.1; 6.6.1; 6.6.3; 6.6.4; 6.6.5; 6.6.5.1; 6.6.5.2; 6.6.7; 6.6.7.1; 6.6.7.2; 7.0.6

References

Timeline

Published
Oct 23, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-203885.3A vulnerability in the password change feature of Cisco Firepower Management Center (FMC) software could allow an unauthenticated, remote atCVE-2024-203897.8A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, loCVE-2024-20396.4The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post(v2) block titleCVE-2024-203905.3A vulnerability in the Dedicated XML Agent feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a deniaCVE-2024-203916.8A vulnerability in the Network Access Manager (NAM) module of Cisco Secure Client could allow an unauthenticated attacker with physical acceCVE-2024-203926.1A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remCVE-2024-203938.8A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers CVE-2024-203945.5A vulnerability in Cisco AppDynamics Network Visibility Agent could allow an unauthenticated, local attacker to cause a denial of service (DCVE-2024-203957.3A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to CVE-2024-203966.5A vulnerability in the protocol handlers of Cisco Webex App could allow an unauthenticated, remote attacker to gain access to sensitive infoCVE-2024-203975.2A vulnerability in the bootloader of Cisco NX-OS Software could allow an unauthenticated attacker with physical access to an affected deviceCVE-2024-203987.8A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to obtain read/write file system access on
CVE-2024-20387: Medium severity, CVSS 5.4 | Vulnix