CVE-2025-20180

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
4.8MEDIUM
EPSS
0.1%
top 84.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Cisco Cisco Secure EmailCisco Cisco Secure Email AND WEB ManagerCisco Asyncos
Timeline
PublishedFeb 5

Description

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the a…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5cisco/cisco_secure_email16 versions+15
▶NVDcisco/asyncos38 versions+37

🔴Vulnerability Details

2
CVEList
Cisco Secure Email and Web Manager and Secure Email Gateway Cross-Site Scripting Vulnerability↗2025-02-05
▶
GHSA
GHSA-xcj6-9mrr-2jw3: A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could↗2025-02-05
▶

📋Vendor Advisories

1
Cisco
Cisco Secure Email and Web Manager and Secure Email Gateway Cross-Site Scripting Vulnerability↗2025-02-05
▶
CVE-2025-20180 (MEDIUM CVSS 4.8) | A vulnerability in the web-based ma | cvebase.io