6.1
Medium
CVE-2024-20258 A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager…
Description
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cisco Secure Email | 15.5.0-048 | No fix stated |
| Cisco Secure Email 15.0 | 15.0.0-104 → 15.0.1-030 | No fix stated |
| Cisco Secure Email | 14.3.0-032 | No fix stated |
| Cisco Secure Email 14.2 | 14.2.0-620 → 14.2.1-020 | No fix stated |
| Cisco Secure Email | 14.0.0-698 | No fix stated |
| Cisco Secure Email 13.5 | 13.5.1-277 → 13.5.4-038 | No fix stated |
| Cisco Secure Email 13.0 | 13.0.0-392 → 13.0.5-007 | No fix stated |
| Cisco Secure Email 12.5 | 12.5.0-066 → 12.5.4-041 | No fix stated |
| Cisco Secure Email 12.1 | 12.1.0-071 → 12.1.0-089 | No fix stated |
Show the 19 other branches Hide the 19 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Cisco Secure Email | 12.0.0-419 | No fix stated |
| Cisco Secure Email 11.1 | 11.1.0-069 → 11.1.0-131 | No fix stated |
| Cisco Secure Email | 11.0.3-238 | No fix stated |
| Cisco Secure Email and Web Manager | 15.0.0-334 | No fix stated |
| Cisco Secure Email and Web Manager | 14.3.0-120 | No fix stated |
| Cisco Secure Email and Web Manager 14.2 | 14.2.0-212 → 14.2.1-020 | No fix stated |
| Cisco Secure Email and Web Manager 14.1 | 14.1.0-223 → 14.1.0-227 | No fix stated |
| Cisco Secure Email and Web Manager | 14.0.0-404 | No fix stated |
| Cisco Secure Email and Web Manager 13.8 | 13.8.1-068 → 13.8.1-108 | No fix stated |
| Cisco Secure Email and Web Manager | 13.6.2-078 | No fix stated |
| Cisco Secure Email and Web Manager | 13.0.0-277 | No fix stated |
| Cisco Secure Email and Web Manager 12.8 | 12.8.1-002 → 12.8.1-021 | No fix stated |
| Cisco Secure Email and Web Manager 12.5 | 12.5.0-636 → 12.5.0-678 | No fix stated |
| Cisco Secure Email and Web Manager 12.0 | 12.0.0-452 → 12.0.1-011 | No fix stated |
| Cisco Secure Email and Web Manager | 11.5.1-105 | No fix stated |
| Cisco Secure Email and Web Manager 11.0 | 11.0.0-115 → 11.0.1-161 | No fix stated |
| Cisco Secure Email and Web Manager | 9.0.0-087 | No fix stated |
| secure_email 11.0 | 11.0.3-238 → 15.5.0-048 | No fix stated |
| secure_email_and_web_manager 9.0 | 9.0.0-087 → 15.0.0-334 | No fix stated |
References
- cisco-sa-esa-sma-wsa-xss-bgG5WHOD sec.cloudapps.cisco.com
Timeline
- Published
- Last modified
Other CVEs of Cisco Secure Email
The 29 CVEs of Cisco Secure Email →
CVE-2026-76519
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
9.8
Critical
CVE-2026-76442
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and…
7.5
High
CVE-2026-76461
Cisco Secure Email Gateway SQL Injection Vulnerability
9.8
Critical
CVE-2026-76443
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and…
9.8
Critical