4.8

CVE-2024-20256: cisco asyncos Cross-site Scripting

CVSS: 4.8v3.1MediumAnalyzed
Published 15-05-2024Last modified 15-08-2024
Open JSON

Vulnerability summary

CVE-2024-20256 is a medium (CVSS 4.8) Cross-site Scripting vulnerability in cisco asyncos. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.7% of scored vulnerabilities.

Overall risk
19/100
0100
Low · default modelHow is this calculated?
CVSS score
4.8/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.29%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 15-05-2024
    PublishedVulnerability first disclosed.
  2. 15-08-2024
    Last modifiedVulnerability information updated.

Description

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Web Appliance could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.29%

Chance of exploitation in the next 30 days

Percentile

21%

Versus all other CVEs

30-day change

0.00 pp

From 0.29% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.29%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Cisco6 products
  • asyncos11.7.0-406 | 11.7.0-418 | 11.7.1-006 | 11.7.1-020 | 11.7.1-049 | 11.7.2-011 | 11.8.0-414 | 11.8.1-023 | 11.8.3-018 | 11.8.3-021 | 12.0.1-268 | 12.0.3-007 | 12.5.1-011 | 12.5.2-007 | 12.5.4-005 | 12.5.5-004 | 12.5.6-008 | 14.0.2-012 | 14.0.3-014 | 14.0.4-005 | 14.5.0-498 | 14.5.1-016 | 15.0.0-322 | 9.0.0-087 | 11.0.0-115 | 11.0.1-161 | 11.5.1-105 | 12.0.0-452 | 12.0.1-011 | 12.5.0-636 | 12.5.0-658 | 12.5.0-670 | 12.5.0-678 | 12.8.1-002 | 12.8.1-021 | 13.0.0-277 | 13.6.2-078 | 13.8.1-068 | 13.8.1-074 | 13.8.1-108 | 14.0.0-404 | 14.1.0-223 | 14.1.0-227 | 14.2.0-212 | 14.2.0-224 | 14.2.1-020 | 14.3.0-120 | 15.0.0-334
  • cisco secure email and web manager9.0.0-087 | 11.0.0-115 | 11.0.1-161 | 11.5.1-105 | 12.0.0-452 | 12.0.1-011 | 12.5.0-636 | 12.5.0-658 | 12.5.0-678 | 12.5.0-670 | 13.0.0-277 | 13.6.2-078 | 13.8.1-068 | 13.8.1-074 | 13.8.1-108 | 12.8.1-002 | 12.8.1-021 | 14.0.0-404 | 14.1.0-223 | 14.1.0-227 | 14.2.0-212 | 14.2.0-224 | 14.2.1-020 | 14.3.0-120 | 15.0.0-334
  • cisco secure web appliance11.7.0-406 | 11.7.0-418 | 11.7.1-049 | 11.7.1-006 | 11.7.1-020 | 11.7.2-011 | 11.8.0-414 | 11.8.1-023 | 11.8.3-018 | 11.8.3-021 | 12.0.1-268 | 12.0.3-007 | 12.5.2-007 | 12.5.1-011 | 12.5.4-005 | 12.5.5-004 | 12.5.6-008 | 14.5.0-498 | 14.5.1-016 | 14.0.3-014 | 14.0.2-012 | 14.0.4-005 | 15.0.0-322
  • secure_email_and_web_manager_virtual_appliance_m100vna
  • secure_email_and_web_manager_virtual_appliance_m300vna

1 vendor · 6 products

References

1 links