CVE-2023-20119

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources

Severity

6.1MEDIUM

EPSS

0.1%

top 72.13%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Cisco Secure Email AND WEB Manager Cisco Secure Email AND WEB Manager Cisco Secure Email Gateway +1 more

Timeline

PublishedJun 28

Description

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, formerly known as Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A success…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages4 packages

▶NVDcisco/secure_email_and_web_manager5 versions+4

▶CVEListV5cisco/cisco_secure_email_and_web_manager23 versions+22

▶NVDcisco/secure_email_gateway5 versions+4

▶NVDcisco/web_security_appliance5 versions+4

🔴Vulnerability Details

GHSA

GHSA-7p5m-p6mr-f6v7: Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Ga↗2023-06-28

▶

CVEList

CVE-2023-20119: A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, formerly known as Content Secu↗2023-06-28

▶

📋Vendor Advisories

Cisco

Cisco Secure Email Gateway, Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance Cross-Site Scripting Vulnerabilities↗2023-06-21

▶