What is the severity of CVE-2024-20392?

CVE-2024-20392 has been rated as a medium severity vulnerability.

How do I fix CVE-2024-20392?

To remediate CVE-2024-20392, ensure that you are running the latest version of Cisco AsyncOS Software for Cisco Secure Email Gateway that addresses this vulnerability.

What kind of attack does CVE-2024-20392 enable?

CVE-2024-20392 allows unauthenticated attackers to conduct an HTTP response splitting attack due to insufficient input validation.

Which software is affected by CVE-2024-20392?

CVE-2024-20392 affects Cisco AsyncOS Software for Cisco Secure Email Gateway.

Is authentication required to exploit CVE-2024-20392?

No, CVE-2024-20392 allows exploitation by unauthenticated remote attackers.

Vulnerability/
CVE-2024-20392

medium

6.1

CWE

113 79 20

15/5/2024

1/8/2024

CVE-2024-20392: XSS

First published: Wed May 15 2024(Updated: )

A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This vulnerability is due to insufficient input validation of some parameters that are passed to the web-based management API of the affected system. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to perform cross-site scripting (XSS) attacks, resulting in the execution of arbitrary script code in the browser of the targeted user, or could allow the attacker to access sensitive, browser-based information.

Credit: ykramarz@cisco.com

Affected Software	Affected Version	How to fix
Cisco AsyncOS

Never miss a vulnerability like this again

Reference Links

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-http-split-GLrnnOwS

Frequently Asked Questions

What is the severity of CVE-2024-20392?
CVE-2024-20392 has been rated as a medium severity vulnerability.
How do I fix CVE-2024-20392?
To remediate CVE-2024-20392, ensure that you are running the latest version of Cisco AsyncOS Software for Cisco Secure Email Gateway that addresses this vulnerability.
What kind of attack does CVE-2024-20392 enable?
CVE-2024-20392 allows unauthenticated attackers to conduct an HTTP response splitting attack due to insufficient input validation.
Which software is affected by CVE-2024-20392?
CVE-2024-20392 affects Cisco AsyncOS Software for Cisco Secure Email Gateway.
Is authentication required to exploit CVE-2024-20392?
No, CVE-2024-20392 allows exploitation by unauthenticated remote attackers.

agent/weakness
agent/references
agent/type
agent/first-publish-date
agent/description
collector/nvd-api
source/NVD
agent/severity
agent/author
agent/event
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/source
agent/softwarecombine
agent/tags
agent/guess-ai
agent/software-canonical-lookup
agent/software-canonical-lookup-request
vendor/cisco
canonical/cisco asyncos

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.