CVE-2024-20392: XSS

Published May 15, 2024
·
Updated

A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This vulnerability is due to insufficient input validation of some parameters that are passed to the web-based management API of the affected system. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to perform cross-site scripting (XSS) attacks, resulting in the execution of arbitrary script code in the browser of the targeted user, or could allow the attacker to access sensitive, browser-based information.

Affected Software

28 affected components
Cisco AsyncOS Software for Cisco Secure Email Gateway
All of the following
Any of the following
Cisco AsyncOS=11.0.3-238
Cisco AsyncOS=11.1.0-069
Cisco AsyncOS=11.1.0-128
Cisco AsyncOS=12.0.0-419
Cisco AsyncOS=12.1.0-071
Cisco AsyncOS=12.1.0-087
Cisco AsyncOS=12.1.0-089
Cisco AsyncOS=12.5.0-066
Cisco AsyncOS=12.5.3-041
Cisco AsyncOS=12.5.4-041
Cisco AsyncOS=13.0.0-392
Cisco AsyncOS=13.0.5-007
Cisco AsyncOS=13.5.1-277
Cisco AsyncOS=13.5.4-038
Cisco AsyncOS=14.0.0-698
Cisco AsyncOS=14.2.0-620
Cisco AsyncOS=14.2.1-020
Cisco AsyncOS=14.3.0-032
Cisco AsyncOS=15.0.0-104
Cisco AsyncOS=15.0.1-030
Cisco AsyncOS=15.5.0-048
Any of the following
Cisco Secure Email Gateway Virtual Appliance C100v
Cisco Secure Email Gateway Virtual Appliance C300v
Cisco Secure Email Gateway Virtual Appliance C600v
Cisco Secure Email Gateway C195
Cisco Secure Email Gateway C395
Cisco Secure Email Gateway C695

Event History

May 15, 2024
CVE Published
via MITRE·05:22 PM
Data Sourced
via MITRE·05:22 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2024-20392?

CVE-2024-20392 has been rated as a medium severity vulnerability.

2

How do I fix CVE-2024-20392?

To remediate CVE-2024-20392, ensure that you are running the latest version of Cisco AsyncOS Software for Cisco Secure Email Gateway that addresses this vulnerability.

3

What kind of attack does CVE-2024-20392 enable?

CVE-2024-20392 allows unauthenticated attackers to conduct an HTTP response splitting attack due to insufficient input validation.

4

Which software is affected by CVE-2024-20392?

CVE-2024-20392 affects Cisco AsyncOS Software for Cisco Secure Email Gateway.

5

Is authentication required to exploit CVE-2024-20392?

No, CVE-2024-20392 allows exploitation by unauthenticated remote attackers.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203