CVE-2024-20504

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-80

Affected software

VendorProductVersions
CiscoCisco Secure Email14.0.0-698; 14.2.0-620; 14.2.1-020; 14.3.0-032; 15.0.0-104; 15.0.1-030; 15.5.0-048; 15.5.1-055
CiscoCisco Secure Email and Web Manager14.0.0-404; 14.1.0-223; 14.1.0-227; 14.2.0-212; 14.2.0-224; 14.2.1-020; 14.3.0-120; 15.0.0-334; 15.5.1-024; 15.5.1-029
CiscoCisco Secure Web Appliance14.1.0-032; 14.1.0-047; 14.1.0-041; 14.0.2-012; 14.5.0-498; 14.0.3-014; 14.0.4-005; 14.5.1-008; 14.5.1-016; 15.0.0-355; 15.0.0-322; 15.1.0-287; 14.5.2-011; 15.2.0-116; 14.0.5-007; 15.2.0-164; 14.5.1-510; 14.5.1-607; 14.5.3-033

References

Timeline

Published
Nov 6, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-205057.5A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 andCVE-2024-205066.1A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 aCVE-2024-205076.5A vulnerability in the logging subsystem of Cisco Meeting Management could allow an authenticated, remote attacker to view sensitive informaCVE-2024-205086.5A vulnerability in Cisco Unified Threat Defense (UTD) Snort Intrusion Prevention System (IPS) Engine for Cisco IOS XE Software could allow aCVE-2024-205095.9A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unCVE-2024-20519.8CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover and unauthorized aCVE-2024-205109.3A vulnerability in the Central Web Authentication (CWA) feature of Cisco IOS XE Software for Wireless Controllers could allow an unauthenticCVE-2024-205116.1A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications CVE-2024-205126.1A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) could allow an unauthCVE-2024-205135.3A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unCVE-2024-205145.4A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure coCVE-2024-205156.5A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker
CVE-2024-20504: Medium severity, CVSS 5.4 | Vulnix