PT-2023-3312 · Cisco · Cisco Secure Email Gateway+2

Published

2023-06-21

·

Updated

2024-01-25

·

CVE-2023-20119

CVSS v2.0

6.4

Medium

VectorAV:N/AC:L/Au:N/C:P/I:P/A:N
Name of the Vulnerable Software and Affected Versions Cisco AsyncOS Software for Cisco Secure Email and Web Manager versions (affected versions not specified) Cisco Secure Email Gateway versions (affected versions not specified) Cisco Secure Web Appliance versions (affected versions not specified)
Description A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This issue is due to insufficient user input validation. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link, potentially allowing the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Recommendations For Cisco AsyncOS Software for Cisco Secure Email and Web Manager, update to a version that includes fixes for the XSS vulnerability. For Cisco Secure Email Gateway, apply the recommended configuration changes to mitigate the risk of XSS attacks. For Cisco Secure Web Appliance, restrict access to the web-based management interface until a patch is available. As a temporary workaround, consider disabling the web-based management interface until a patch is available. Avoid using the interface until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-03457
CVE-2023-20119

Affected Products

Cisco Asyncos
Cisco Secure Email Gateway
Cisco Secure Web Appliance