Description
A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack.
This vulnerability is due to insufficient input validation of some parameters that are passed to the web-based management API of the affected system. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to perform cross-site scripting (XSS) attacks, resulting in the execution of arbitrary script code in the browser of the targeted user, or could allow the attacker to access sensitive, browser-based information.
This vulnerability is due to insufficient input validation of some parameters that are passed to the web-based management API of the affected system. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to perform cross-site scripting (XSS) attacks, resulting in the execution of arbitrary script code in the browser of the targeted user, or could allow the attacker to access sensitive, browser-based information.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Cisco | Cisco Secure Email | affected |
|
Configuration 1 [-]
| AND |
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-18107 | A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This vulnerability is due to insufficient input validation of some parameters that are passed to the web-based management API of the affected system. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to perform cross-site scripting (XSS) attacks, resulting in the execution of arbitrary script code in the browser of the targeted user, or could allow the attacker to access sensitive, browser-based information. |
References
History
Wed, 06 Aug 2025 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Cisco
Cisco asyncos Cisco secure Email Gateway C195 Cisco secure Email Gateway C395 Cisco secure Email Gateway C695 Cisco secure Email Gateway Virtual Appliance C100v Cisco secure Email Gateway Virtual Appliance C300v Cisco secure Email Gateway Virtual Appliance C600v |
|
| CPEs | cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c100v:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c300v:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c600v:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:secure_email_gateway_c195:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:secure_email_gateway_c395:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:secure_email_gateway_c695:-:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:11.0.3-238:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:11.1.0-069:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:11.1.0-128:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:12.0.0-419:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:12.1.0-071:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:12.1.0-087:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:12.1.0-089:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:12.5.0-066:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:12.5.3-041:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:12.5.4-041:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:13.0.0-392:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:13.0.5-007:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:13.5.1-277:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:13.5.4-038:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:14.0.0-698:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:14.2.0-620:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:14.2.1-020:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:14.3.0-032:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:15.0.0-104:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:15.0.1-030:*:*:*:*:*:*:* cpe:2.3:o:cisco:asyncos:15.5.0-048:*:*:*:*:*:*:* |
|
| Vendors & Products |
Cisco
Cisco asyncos Cisco secure Email Gateway C195 Cisco secure Email Gateway C395 Cisco secure Email Gateway C695 Cisco secure Email Gateway Virtual Appliance C100v Cisco secure Email Gateway Virtual Appliance C300v Cisco secure Email Gateway Virtual Appliance C600v |
Subscriptions
Cisco
Subscribe
Asyncos
Subscribe
Secure Email Gateway C195
Subscribe
Secure Email Gateway C395
Subscribe
Secure Email Gateway C695
Subscribe
Secure Email Gateway Virtual Appliance C100v
Subscribe
Secure Email Gateway Virtual Appliance C300v
Subscribe
Secure Email Gateway Virtual Appliance C600v
Subscribe
MITRE
Status: PUBLISHED
Assigner: cisco
Published:
Updated: 2024-08-01T21:59:42.424Z
Reserved: 2023-11-08T15:08:07.659Z
Link: CVE-2024-20392
Vulnrichment
Updated: 2024-05-15T19:22:00.807Z
NVD
Status : Analyzed
Published: 2024-05-15T18:15:10.390
Modified: 2025-08-06T16:48:40.873
Link: CVE-2024-20392
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses