MEDIUM✓ PATCH🇵🇱 Wersja polska

CVE-2023-20028

CVSS 5.4v3.1pub. 2023-06-28upd. 2024-11-21

Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, formerly Cisco Email Security Appliance (ESA); and Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow a remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities, see the Details section of this advisory.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

  • Cisco Secure Email And Web Manager

    APP
    Cisco
    14.0.0-41814.0.1-03314.0.1-05315.0.0-05015.0.0-256

  • Cisco Secure Email Gateway

    APP
    Cisco
    14.0.0-41814.0.1-03314.0.1-05315.0.0-05015.0.0-256

  • Cisco Web Security Appliance

    APP
    Cisco
    14.0.0-41814.0.1-03314.0.1-05315.0.0-05015.0.0-256
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2024-20401CRITICAL9.8PL ✓same product

Cisco Secure Email Gateway — nadpisywanie dowolnych plików przez załącznik e-mail

CVE-2023-31488CRITICAL9.8PL ✓same product

RCE w Hyland Perceptive Filters — błąd segmentacji przy przetwarzaniu dokumentów

CVE-2023-20032CRITICAL9.8PL ✓same product

ClamAV: RCE przez buffer overflow w parserze partycji HFS+

CVE-2022-20798CRITICAL9.8PL ✓same product

Cisco ESA/SMA: pominięcie uwierzytelnienia LDAP w interfejsie webowym

CVE-2022-20664HIGH7.7same product

A vulnerability in the web management interface of Cisco Secure Email and Web Manager, formerly Cisco Security...