Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
CVE-2024-20258 Details
Description
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 16, 2024Exploitation: NoneAutomatable: NoTechnical Impact: Partial
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cisco asyncos | < 15.0.2-034 >= 15.5, < 15.5.1-055 < 15.5.1-024 |
CPE
Remediation
| |
| cisco secure email gateway virtual appliance c100v | All versions |
CPE
Remediation
| |
| cisco secure email gateway virtual appliance c300v | All versions |
CPE
Remediation
| |
| cisco secure email gateway virtual appliance c600v | All versions |
CPE
Remediation
| |
| cisco secure email gateway c190 | All versions |
CPE
Remediation
| |
| cisco secure email gateway c195 | All versions |
CPE
Remediation
| |
| cisco secure email gateway c390 | All versions |
CPE
Remediation
| |
| cisco secure email gateway c395 | All versions |
CPE
Remediation
| |
| cisco secure email gateway c690 | All versions |
CPE
Remediation
| |
| cisco secure email gateway c690x | All versions |
CPE
Remediation
| |
| cisco secure email gateway c695 | All versions |
CPE
Remediation
| |
| cisco secure email and web manager virtual appliance m100v | All versions |
CPE
Remediation
| |
| cisco secure email and web manager virtual appliance m300v | All versions |
CPE
Remediation
| |
| cisco secure email and web manager virtual appliance m600v | All versions |
CPE
Remediation
| |
| cisco secure email and web manager m170 | All versions |
CPE
Remediation
| |
| cisco secure email and web manager m190 | All versions |
CPE
Remediation
| |
| cisco secure email and web manager m195 | All versions |
CPE
Remediation
| |
| cisco secure email and web manager m380 | All versions |
CPE
Remediation
| |
| cisco secure email and web manager m390 | All versions |
CPE
Remediation
| |
| cisco secure email and web manager m390x | All versions |
CPE
Remediation
| |
| cisco secure email and web manager m395 | All versions |
CPE
Remediation
| |
| cisco secure email and web manager m680 | All versions |
CPE
Remediation
| |
| cisco secure email and web manager m690 | All versions |
CPE
Remediation
| |
| cisco secure email and web manager m690x | All versions |
CPE
Remediation
| |
| cisco secure email and web manager m695 | All versions |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jul 31, 2025 | Reanalysis | [email protected] |
| Jun 30, 2025 | Initial Analysis | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| Jul 3, 2024 | CVE Modified | CISA-ADP |
| May 15, 2024 | New CVE Received | [email protected] |