A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, formerly known as Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.

This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00081.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Cisco Cisco Secure Email and Web Manager affected
Version Status Constraints
11.0.0-115 affected
—
11.0.1-161 affected
—
11.5.1-105 affected
—
12.0.0-452 affected
—
12.0.1-011 affected
—
12.5.0-636 affected
—
12.5.0-658 affected
—
12.5.0-678 affected
—
12.5.0-670 affected
—
13.0.0-277 affected
—
13.6.2-078 affected
—
13.8.1-068 affected
—
13.8.1-074 affected
—
13.8.1-108 affected
—
12.8.1-002 affected
—
12.8.1-021 affected
—
14.0.0-404 affected
—
14.1.0-223 affected
—
14.1.0-227 affected
—
14.2.0-212 affected
—
14.2.0-224 affected
—
14.2.1-020 affected
—
14.3.0-120 affected
—

Configuration 1 [-]

OR cpe:2.3:a:cisco:secure_email_and_web_manager:14.0.0-418:*:*:*:*:*:*:*
cpe:2.3:a:cisco:secure_email_and_web_manager:14.0.1-033:*:*:*:*:*:*:*
cpe:2.3:a:cisco:secure_email_and_web_manager:14.0.1-053:*:*:*:*:*:*:*
cpe:2.3:a:cisco:secure_email_and_web_manager:15.0.0-050:*:*:*:*:*:*:*
cpe:2.3:a:cisco:secure_email_and_web_manager:15.0.0-256:*:*:*:*:*:*:*
cpe:2.3:a:cisco:secure_email_gateway:14.0.0-418:*:*:*:*:*:*:*
cpe:2.3:a:cisco:secure_email_gateway:14.0.1-033:*:*:*:*:*:*:*
cpe:2.3:a:cisco:secure_email_gateway:14.0.1-053:*:*:*:*:*:*:*
cpe:2.3:a:cisco:secure_email_gateway:15.0.0-050:*:*:*:*:*:*:*
cpe:2.3:a:cisco:secure_email_gateway:15.0.0-256:*:*:*:*:*:*:*
cpe:2.3:a:cisco:web_security_appliance:14.0.0-418:*:*:*:*:*:*:*
cpe:2.3:a:cisco:web_security_appliance:14.0.1-033:*:*:*:*:*:*:*
cpe:2.3:a:cisco:web_security_appliance:14.0.1-053:*:*:*:*:*:*:*
cpe:2.3:a:cisco:web_security_appliance:15.0.0-050:*:*:*:*:*:*:*
cpe:2.3:a:cisco:web_security_appliance:15.0.0-256:*:*:*:*:*:*:*

No data.

No data.

Subscriptions

Vendors Products
Cisco Subscribe
Secure Email And Web Manager Subscribe
Secure Email Gateway Subscribe
Web Security Appliance Subscribe

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-24298 A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, formerly known as Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-xss-cP9DuEmq cve-icon cve-icon
History

Thu, 21 Nov 2024 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2024-11-21T21:41:13.822Z

Reserved: 2022-10-27T00:00:00.000Z

Link: CVE-2023-20119

cve-icon Vulnrichment

Updated: 2024-08-02T08:57:36.063Z

cve-icon NVD

Status : Modified

Published: 2023-06-28T15:15:09.700

Modified: 2024-11-21T07:40:36.027

Link: CVE-2023-20119

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses