6.1

CVE-2024-20258: cisco asyncos Cross-site Scripting

CVSS: 6.1v3.1MediumAnalyzed
Published 15-05-2024Last modified 01-08-2024
Open JSON

Vulnerability summary

CVE-2024-20258 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in cisco asyncos. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.4% of scored vulnerabilities.

Overall risk
24/100
0100
Low · default modelHow is this calculated?
CVSS score
6.1/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.32%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 15-05-2024
    PublishedVulnerability first disclosed.
  2. 01-08-2024
    Last modifiedVulnerability information updated.

Description

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.32%

Chance of exploitation in the next 30 days

Percentile

23%

Versus all other CVEs

30-day change

0.00 pp

From 0.32% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.32%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Cisco3 products
  • asyncos< 15.0.2-034 | ≥ 15.5, < 15.5.1-055 | < 15.5.1-024
  • cisco secure email11.0.3-238 | 11.1.0-069 | 11.1.0-131 | 11.1.0-128 | 12.0.0-419 | 12.1.0-071 | 12.1.0-087 | 12.1.0-089 | 13.0.0-392 | 13.0.5-007 | 13.5.1-277 | 13.5.4-038 | 12.5.0-066 | 12.5.4-041 | 12.5.3-041 | 14.0.0-698 | 14.2.0-620 | 14.2.1-020 | 14.3.0-032 | 15.0.0-104 | 15.0.1-030 | 15.5.0-048
  • cisco secure email and web manager9.0.0-087 | 11.0.0-115 | 11.0.1-161 | 11.5.1-105 | 12.0.0-452 | 12.0.1-011 | 12.5.0-636 | 12.5.0-658 | 12.5.0-678 | 12.5.0-670 | 13.0.0-277 | 13.6.2-078 | 13.8.1-068 | 13.8.1-074 | 13.8.1-108 | 12.8.1-002 | 12.8.1-021 | 14.0.0-404 | 14.1.0-223 | 14.1.0-227 | 14.2.0-212 | 14.2.0-224 | 14.2.1-020 | 14.3.0-120 | 15.0.0-334

1 vendor · 3 products

References

1 links