Description
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Operator.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Secure Email | 14.0.0-698; 13.5.1-277; 13.0.0-392; 14.2.0-620; 13.0.5-007; 13.5.4-038; 14.2.1-020; 14.3.0-032; 15.0.0-104; 15.0.1-030; 15.5.0-048; 15.5.1-055; 15.5.2-018; 16.0.0-050; 15.0.3-002; 16.0.0-054 |
| Cisco | Cisco Secure Email and Web Manager | 13.6.2-023; 13.6.2-078; 13.0.0-249; 13.0.0-277; 13.8.1-052; 13.8.1-068; 13.8.1-074; 14.0.0-404; 12.8.1-002; 14.1.0-227; 13.6.1-201; 14.2.0-203; 14.2.0-212; 12.8.1-021; 13.8.1-108; 14.2.0-224; 14.3.0-120; 15.0.0-334; 15.5.1-024; 15.5.1-029 |
References
Timeline
- Published
- Feb 5, 2025
- Last modified
- Jun 17, 2026
- NVD status
- Analyzed