Vulnerability-Lookup

WID-SEC-W-2024-3349

Vulnerability from csaf_certbund - Published: 2024-11-06 23:00 - Updated: 2024-11-06 23:00

Summary

Cisco AsyncOS: Schwachstelle ermöglicht Cross-Site Scripting

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Cisco AsyncOS ist ein Betriebssystem für Cisco Appliances. Das Cisco Secure Email Gateway ist eine Sicherheitslösung zum Schutz der E-Mail Kommunikation. Cisco Secure Web Appliance (ehem. Cisco Web Security) bietet einen on-premise Web Proxy mit Schutz vor vielen Bedrohungen.

Angriff: Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Cisco AsyncOS, Cisco Secure Email Gateway und Cisco Secure Web Appliance ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Betroffene Betriebssysteme: - CISCO Appliance

CVE-2024-20504

In Cisco AsyncOS, wie es unter anderem im Cisco Secure Email Gateway und der Cisco Secure Web Appliance verwendet wird, existiert eine Cross-Site Scripting Schwachstelle. HTML und Script-Eingaben werden nicht ordnungsgemäß überprüft, bevor sie an den Benutzer zurückgegeben werden. Ein entfernter, authentisierter Angreifer kann durch Ausnutzung dieser Schwachstelle beliebigen HTML- und Script-Code durch den Browser des Benutzers im Kontext der betroffenen Seite ausführen. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich.

Affected products

Known affected 6 products

Product	Identifier	Version
Cisco AsyncOS <15.2.1-011 Cisco / AsyncOS		<15.2.1-011
Cisco AsyncOS <15.0.1-004 Cisco / AsyncOS		<15.0.1-004
Cisco Secure Email Gateway Cisco	`cpe:/h:cisco:secure_email_gateway:-`	—
Cisco AsyncOS <16.0.0-50 Cisco / AsyncOS		<16.0.0-50
Cisco AsyncOS <16.0.0-195 Cisco / AsyncOS		<16.0.0-195
Cisco Secure Web Appliance Cisco	`cpe:/h:cisco:secure_web_appliance:-`	—

References

3 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://sec.cloudapps.cisco.com/security/center/c…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Cisco AsyncOS ist ein Betriebssystem f\u00fcr Cisco Appliances.\r\nDas Cisco Secure Email Gateway ist eine Sicherheitsl\u00f6sung zum Schutz der E-Mail Kommunikation.\r\nCisco Secure Web Appliance (ehem. Cisco Web Security) bietet einen on-premise Web Proxy mit Schutz vor vielen Bedrohungen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Cisco AsyncOS, Cisco Secure Email Gateway und Cisco Secure Web Appliance ausnutzen, um einen Cross-Site Scripting Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- CISCO Appliance",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-3349 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3349.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-3349 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3349"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisory vom 2024-11-06",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-wsa-sma-xss-zYm3f49n"
      }
    ],
    "source_lang": "en-US",
    "title": "Cisco AsyncOS: Schwachstelle erm\u00f6glicht Cross-Site Scripting",
    "tracking": {
      "current_release_date": "2024-11-06T23:00:00.000+00:00",
      "generator": {
        "date": "2024-11-07T09:03:32.692+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.8"
        }
      },
      "id": "WID-SEC-W-2024-3349",
      "initial_release_date": "2024-11-06T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-11-06T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c16.0.0-195",
                "product": {
                  "name": "Cisco AsyncOS \u003c16.0.0-195",
                  "product_id": "T038799"
                }
              },
              {
                "category": "product_version",
                "name": "16.0.0-195",
                "product": {
                  "name": "Cisco AsyncOS 16.0.0-195",
                  "product_id": "T038799-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:asyncos:16.0.0-195"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c16.0.0-50",
                "product": {
                  "name": "Cisco AsyncOS \u003c16.0.0-50",
                  "product_id": "T038800"
                }
              },
              {
                "category": "product_version",
                "name": "16.0.0-50",
                "product": {
                  "name": "Cisco AsyncOS 16.0.0-50",
                  "product_id": "T038800-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:asyncos:16.0.0-50"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c15.0.1-004",
                "product": {
                  "name": "Cisco AsyncOS \u003c15.0.1-004",
                  "product_id": "T038801"
                }
              },
              {
                "category": "product_version",
                "name": "15.0.1-004",
                "product": {
                  "name": "Cisco AsyncOS 15.0.1-004",
                  "product_id": "T038801-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:asyncos:15.0.1-004"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c15.2.1-011",
                "product": {
                  "name": "Cisco AsyncOS \u003c15.2.1-011",
                  "product_id": "T038802"
                }
              },
              {
                "category": "product_version",
                "name": "15.2.1-011",
                "product": {
                  "name": "Cisco AsyncOS 15.2.1-011",
                  "product_id": "T038802-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:asyncos:15.2.1-011"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "AsyncOS"
          },
          {
            "category": "product_name",
            "name": "Cisco Secure Email Gateway",
            "product": {
              "name": "Cisco Secure Email Gateway",
              "product_id": "T036339",
              "product_identification_helper": {
                "cpe": "cpe:/h:cisco:secure_email_gateway:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Cisco Secure Web Appliance",
            "product": {
              "name": "Cisco Secure Web Appliance",
              "product_id": "T034850",
              "product_identification_helper": {
                "cpe": "cpe:/h:cisco:secure_web_appliance:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-20504",
      "notes": [
        {
          "category": "description",
          "text": "In Cisco AsyncOS, wie es unter anderem im Cisco Secure Email Gateway und der Cisco Secure Web Appliance verwendet wird, existiert eine Cross-Site Scripting Schwachstelle. HTML und Script-Eingaben werden nicht ordnungsgem\u00e4\u00df \u00fcberpr\u00fcft, bevor sie an den Benutzer zur\u00fcckgegeben werden. Ein entfernter, authentisierter Angreifer kann durch Ausnutzung dieser Schwachstelle beliebigen HTML- und Script-Code durch den Browser des Benutzers im Kontext der betroffenen Seite ausf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich."
        }
      ],
      "product_status": {
        "known_affected": [
          "T038802",
          "T038801",
          "T036339",
          "T038800",
          "T038799",
          "T034850"
        ]
      },
      "release_date": "2024-11-06T23:00:00.000+00:00",
      "title": "CVE-2024-20504"
    }
  ]
}

CVE-2024-20504 (GCVE-0-2024-20504)

Vulnerability from cvelistv5 – Published: 2024-11-06 16:29 – Updated: 2024-11-06 17:05

Title

Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Stored Cross-Site Scripting Vulnerabilities

Summary

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-06 17:05 UTC

CWE

CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Assigner

cisco mitre root

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

3 products

Vendor	Product	Version
Cisco	Cisco Secure Email	Affected: 14.0.0-698 Affected: 14.2.0-620 Affected: 14.2.1-020 Affected: 14.3.0-032 Affected: 15.0.0-104 Affected: 15.0.1-030 Affected: 15.5.0-048 Affected: 15.5.1-055
Cisco	Cisco Secure Email and Web Manager	Affected: 14.0.0-404 Affected: 14.1.0-223 Affected: 14.1.0-227 Affected: 14.2.0-212 Affected: 14.2.0-224 Affected: 14.2.1-020 Affected: 14.3.0-120 Affected: 15.0.0-334 Affected: 15.5.1-024 Affected: 15.5.1-029
Cisco	Cisco Secure Web Appliance	Affected: 14.1.0-032 Affected: 14.1.0-047 Affected: 14.1.0-041 Affected: 14.0.2-012 Affected: 14.5.0-498 Affected: 14.0.3-014 Affected: 14.0.4-005 Affected: 14.5.1-008 Affected: 14.5.1-016 Affected: 15.0.0-355 Affected: 15.0.0-322 Affected: 15.1.0-287 Affected: 14.5.2-011 Affected: 15.2.0-116 Affected: 14.0.5-007 Affected: 15.2.0-164 Affected: 14.5.1-510 Affected: 14.5.1-607 Affected: 14.5.3-033

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20504",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T17:05:32.372312Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T17:05:40.097Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Secure Email",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "14.0.0-698"
            },
            {
              "status": "affected",
              "version": "14.2.0-620"
            },
            {
              "status": "affected",
              "version": "14.2.1-020"
            },
            {
              "status": "affected",
              "version": "14.3.0-032"
            },
            {
              "status": "affected",
              "version": "15.0.0-104"
            },
            {
              "status": "affected",
              "version": "15.0.1-030"
            },
            {
              "status": "affected",
              "version": "15.5.0-048"
            },
            {
              "status": "affected",
              "version": "15.5.1-055"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Cisco Secure Email and Web Manager",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "14.0.0-404"
            },
            {
              "status": "affected",
              "version": "14.1.0-223"
            },
            {
              "status": "affected",
              "version": "14.1.0-227"
            },
            {
              "status": "affected",
              "version": "14.2.0-212"
            },
            {
              "status": "affected",
              "version": "14.2.0-224"
            },
            {
              "status": "affected",
              "version": "14.2.1-020"
            },
            {
              "status": "affected",
              "version": "14.3.0-120"
            },
            {
              "status": "affected",
              "version": "15.0.0-334"
            },
            {
              "status": "affected",
              "version": "15.5.1-024"
            },
            {
              "status": "affected",
              "version": "15.5.1-029"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Cisco Secure Web Appliance",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "14.1.0-032"
            },
            {
              "status": "affected",
              "version": "14.1.0-047"
            },
            {
              "status": "affected",
              "version": "14.1.0-041"
            },
            {
              "status": "affected",
              "version": "14.0.2-012"
            },
            {
              "status": "affected",
              "version": "14.5.0-498"
            },
            {
              "status": "affected",
              "version": "14.0.3-014"
            },
            {
              "status": "affected",
              "version": "14.0.4-005"
            },
            {
              "status": "affected",
              "version": "14.5.1-008"
            },
            {
              "status": "affected",
              "version": "14.5.1-016"
            },
            {
              "status": "affected",
              "version": "15.0.0-355"
            },
            {
              "status": "affected",
              "version": "15.0.0-322"
            },
            {
              "status": "affected",
              "version": "15.1.0-287"
            },
            {
              "status": "affected",
              "version": "14.5.2-011"
            },
            {
              "status": "affected",
              "version": "15.2.0-116"
            },
            {
              "status": "affected",
              "version": "14.0.5-007"
            },
            {
              "status": "affected",
              "version": "15.2.0-164"
            },
            {
              "status": "affected",
              "version": "14.5.1-510"
            },
            {
              "status": "affected",
              "version": "14.5.1-607"
            },
            {
              "status": "affected",
              "version": "14.5.3-033"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface.\r\n\r\nThis vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-06T16:29:37.791Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-esa-wsa-sma-xss-zYm3f49n",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-wsa-sma-xss-zYm3f49n"
        }
      ],
      "source": {
        "advisory": "cisco-sa-esa-wsa-sma-xss-zYm3f49n",
        "defects": [
          "CSCwj72814"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Stored Cross-Site Scripting Vulnerabilities"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20504",
    "datePublished": "2024-11-06T16:29:37.791Z",
    "dateReserved": "2023-11-08T15:08:07.687Z",
    "dateUpdated": "2024-11-06T17:05:40.097Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.