csirt@kutim:~/threat-intel/cve/CVE-2024-20256

Katalog CVE

CVSS 4.8 · Medium EPSS 0,29%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada cisco asyncos, cisco secure email and web manager virtual appliance m100v +2 lainnya. Skor CVSS 3.1 4.8 (Medium) menurut cisco.com.

Deskripsi (NVD)

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Web Appliance could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Rincian

Terbit di NVD
15 Mei 2024
Terakhir diubah
17 Juni 2026
Status NVD
Analyzed
CVSS 3.1
4.8 (Medium), sumber cisco.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari)
0,29% peluang dieksploitasi; lebih tinggi dari 20,4% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
cisco asyncos Versi 11.7.0-406
cisco asyncos Versi 11.7.0-418
cisco asyncos Versi 11.7.1-006
cisco asyncos Versi 11.7.1-020
cisco asyncos Versi 11.7.1-049
cisco asyncos Versi 11.7.2-011
cisco asyncos Versi 11.8.0-414
cisco asyncos Versi 11.8.1-023
cisco asyncos Versi 11.8.3-018
cisco asyncos Versi 11.8.3-021
cisco asyncos Versi 12.0.1-268
cisco asyncos Versi 12.0.3-007
cisco asyncos Versi 12.5.1-011
cisco asyncos Versi 12.5.2-007
cisco asyncos Versi 12.5.4-005
cisco asyncos Versi 12.5.5-004
cisco asyncos Versi 12.5.6-008
cisco asyncos Versi 14.0.2-012
cisco asyncos Versi 14.0.3-014
cisco asyncos Versi 14.0.4-005
cisco asyncos Versi 14.5.0-498
cisco asyncos Versi 14.5.1-016
cisco asyncos Versi 15.0.0-322
cisco secure email and web manager virtual appliance m100v Semua versi
cisco secure email and web manager virtual appliance m300v Semua versi
cisco secure email and web manager virtual appliance m600v Semua versi
cisco asyncos Versi 9.0.0-087
cisco asyncos Versi 11.0.0-115
cisco asyncos Versi 11.0.1-161
cisco asyncos Versi 11.5.1-105
cisco asyncos Versi 12.0.0-452
cisco asyncos Versi 12.0.1-011
cisco asyncos Versi 12.5.0-636
cisco asyncos Versi 12.5.0-658
cisco asyncos Versi 12.5.0-670
cisco asyncos Versi 12.5.0-678
cisco asyncos Versi 12.8.1-002
cisco asyncos Versi 12.8.1-021
cisco asyncos Versi 13.0.0-277
cisco asyncos Versi 13.6.2-078
cisco asyncos Versi 13.8.1-068
cisco asyncos Versi 13.8.1-074
cisco asyncos Versi 13.8.1-108
cisco asyncos Versi 14.0.0-404
cisco asyncos Versi 14.1.0-223
cisco asyncos Versi 14.1.0-227
cisco asyncos Versi 14.2.0-212
cisco asyncos Versi 14.2.0-224
cisco asyncos Versi 14.2.1-020
cisco asyncos Versi 14.3.0-120
cisco asyncos Versi 15.0.0-334

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.