CVE-2024-20475

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by inserting malicious data into a specific data field in an affected interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
CiscoCisco Catalyst SD-WAN Manager20.6.1; 20.6.1.1; 20.6.0.18.3; 20.6.0.18.4; 20.6.1.0.1; 20.6.2; 20.7.1EFT2; 20.7.1; 20.6.2.1; 20.6.2.2; 20.7.1.1; 20.6.2.2.2; 20.6.2.2.3; 20.6.2.0.4; 20.6.2.2.7; 20.6.3; 20.7.1.0.2; 20.8.1; 20.6.3.0.7; 20.6.3.0.5

References

Timeline

Published
Sep 25, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-204764.9A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorizationCVE-2024-204775.4A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delCVE-2024-204787.2A vulnerability in the software upgrade component of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network CVE-2024-204794.8A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack agCVE-2024-20489.8Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CCVE-2024-204808.6A vulnerability in the DHCP Snooping feature of Cisco IOS XE Software on Software-Defined Access (SD-Access) fabric edge nodes could allow aCVE-2024-204815.8A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefeCVE-2024-204826.5A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower ManagemeCVE-2024-204837.2Multiple vulnerabilities in Cisco Routed PON Controller Software, which runs as a docker container on hardware that is supported by Cisco IOCVE-2024-204847.5A vulnerability in the External Agent Assignment Service (EAAS) feature of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticaCVE-2024-204856.7A vulnerability in the VPN web server of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software CVE-2024-204868.8A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacke
CVE-2024-20475: Medium severity, CVSS 5.4 | Vulnix