CVE-2024-20341
Cisco Adaptive Security Appliance WebVPN Cross-Site Scripting Vulnerability
Description
A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a browser that is accessing an affected device. This vulnerability is due to improper validation of user-supplied input to application endpoints. An attacker could exploit this vulnerability by persuading a user to follow a link designed to submit malicious input to the affected application. A successful exploit could allow the attacker to execute arbitrary HTML or script code in the browser in the context of the web services page.
Weakness: CWE-80
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco Adaptive Security Appliance (ASA) Check your version | Firewall / NGFW | cna-assigner |
| Cisco | Cisco Firepower Threat Defense (FTD) Check your version | Firewall / NGFW | cna-assigner |
Vendor-reported products (2)
- Cisco · Cisco Adaptive Security Appliance (ASA) Software
- Cisco · Cisco Firepower Threat Defense Software
Vendor advisory
Cisco Adaptive Security Appliance and Firepower Threat Defense Software VPN Web Client Services Cross-Site Scripting Vulnerabilities
Cisco’s rating: Medium (advisory CVSS 6.1) · Published Oct 23, 2024
Bug IDs: CSCwi12284 , CSCwj49745
The vendor’s rating applies to the whole advisory and can differ from this CVE’s own CVSS severity. Where this comes from
References
- cisco-sa-asaftd-xss-yjj7ZjVq
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-M446vbEO
- Cisco Event Response: October 2024 Semiannual Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-xss-yjj7ZjVq