CVE-2023-20119

Опубликовано: 28 июн. 2023

Источник: nvd

CVSS3: 6.1

EPSS Низкий

Описание

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, formerly known as Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.

This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cisco:secure_email_and_web_manager:14.0.0-418:*:*:*:*:*:*:*

cpe:2.3:a:cisco:secure_email_and_web_manager:14.0.1-033:*:*:*:*:*:*:*

cpe:2.3:a:cisco:secure_email_and_web_manager:14.0.1-053:*:*:*:*:*:*:*

cpe:2.3:a:cisco:secure_email_and_web_manager:15.0.0-050:*:*:*:*:*:*:*

cpe:2.3:a:cisco:secure_email_and_web_manager:15.0.0-256:*:*:*:*:*:*:*

cpe:2.3:a:cisco:secure_email_gateway:14.0.0-418:*:*:*:*:*:*:*

cpe:2.3:a:cisco:secure_email_gateway:14.0.1-033:*:*:*:*:*:*:*

cpe:2.3:a:cisco:secure_email_gateway:14.0.1-053:*:*:*:*:*:*:*

cpe:2.3:a:cisco:secure_email_gateway:15.0.0-050:*:*:*:*:*:*:*

cpe:2.3:a:cisco:secure_email_gateway:15.0.0-256:*:*:*:*:*:*:*

cpe:2.3:a:cisco:web_security_appliance:14.0.0-418:*:*:*:*:*:*:*

cpe:2.3:a:cisco:web_security_appliance:14.0.1-033:*:*:*:*:*:*:*

cpe:2.3:a:cisco:web_security_appliance:14.0.1-053:*:*:*:*:*:*:*

cpe:2.3:a:cisco:web_security_appliance:15.0.0-050:*:*:*:*:*:*:*

cpe:2.3:a:cisco:web_security_appliance:15.0.0-256:*:*:*:*:*:*:*

EPSS

Процентиль: 24%

0.00081

Низкий

6.1 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-7p5m-p6mr-f6v7

CVSS3: 5.4

github

больше 2 лет назад

Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, formerly Cisco Email Security Appliance (ESA); and Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow a remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities, see the Details section of this advisory.

BDU:2023-03457