CVE-2024-20504mediumCWE-80

CVE-2024-20504: fallo de gravedad media en Cisco Secure Email

Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Stored Cross-Site Scripting Vulnerabilities

Publicada el

Seguir esta CVE+ Monitorear Cisco Secure Email+ Monitorear Cisco Secure Email and Web Manager

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.4epss 0.3%
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Productos afectados
Cisco · Cisco Secure EmailCisco · Cisco Secure Email and Web ManagerCisco · Cisco Secure Web Appliance
CVEs relacionadas — Cisco Secure Email

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-76461CRITICALCisco Secure Email Gateway SQL Injection VulnerabilityEPSS 40.2%KEVCVE-2025-20393CRITICALCisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution VulnerabilityEPSS 32.4%KEVCVE-2026-76519CRITICALCisco Secure Email Gateway Arbitrary File Write VulnerabilityEPSS 6.2%KEVCVE-2023-20032CRITICALCVE-2023-20032EPSS 30.1%CVE-2026-76443CRITICALCisco Secure Email Gateway Security Hardening ReleaseEPSS 2.4%CVE-2024-20401CRITICALCVE-2024-20401EPSS 2.3%