CVE-2024-20504

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)

Published: Nov 6, 2024 / Updated: 13d ago

Nessus Plugin ID 210599 with Medium Severity Synopsis The remote device is missing a vendor-supplied security patch. Description According to its self-reported version, Secure Web Appliance is affected by a vulnerability. - A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. (CVE-2024-20504) Please see the included Cisco BID and Cisco Security Advisory for more information. Solution Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwj72814 Read more at https://www.tenable.com/plugins/nessus/210599

CVE Alert: CVE-2024-20504 - https://www. redpacketsecurity.com/cve_aler t_cve-2024-20504/ # OSINT # ThreatIntel # CyberSecurity # cve_2024_20504

An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks. This security bulletin contains one low risk vulnerability.

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user input. […]