CVE-2024-20264: Cisco Firepower Management Center Software Cross-Site Scripting Vulnerability

Published Oct 23, 2024

Updated

A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by inserting crafted input into various data fields in an affected interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface, or access sensitive, browser-based information.

Affected Software

16 affected components

Cisco Secure Firewall Management Center

Cisco Secure Firewall Management Center=7.1.0

Cisco Secure Firewall Management Center=7.1.0.1

Cisco Secure Firewall Management Center=7.1.0.2

Cisco Secure Firewall Management Center=7.1.0.3

Cisco Secure Firewall Management Center=7.2.0

Cisco Secure Firewall Management Center=7.2.0.1

Cisco Secure Firewall Management Center=7.2.1

Cisco Secure Firewall Management Center=7.2.2

Cisco Secure Firewall Management Center=7.2.3

Cisco Secure Firewall Management Center=7.2.3.1

Cisco Secure Firewall Management Center=7.2.4

Cisco Secure Firewall Management Center=7.2.4.1

Cisco Secure Firewall Management Center=7.2.5

Cisco Secure Firewall Management Center=7.2.5.1

Cisco Secure Firewall Management Center=7.2.5.2

Event History

Oct 23, 2024

CVE Published

via MITRE·05:06 PM

Data Sourced

via MITRE·05:06 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-20264?

CVE-2024-20264 is classified as a medium severity vulnerability.

How do I fix CVE-2024-20264?

To fix CVE-2024-20264, upgrade the Cisco Secure Firewall Management Center to the latest patched version.

What type of attack does CVE-2024-20264 enable?

CVE-2024-20264 enables an authenticated remote attacker to conduct a cross-site scripting (XSS) attack.

Which versions of Cisco Secure Firewall Management Center are affected by CVE-2024-20264?

CVE-2024-20264 affects multiple versions, including 7.1.0 through 7.2.5.2.

Is user authentication required to exploit CVE-2024-20264?

Yes, CVE-2024-20264 requires an authenticated user to exploit the vulnerability.