Cisco ASA: CVE-2024-20382: Cisco Adaptive Security Appliance and Firepower Threat Defense Software VPN Web Client Services Cross-Site Scripting Vulnerabilities

Cisco ASA: CVE-2024-20382: Cisco Adaptive Security Appliance and Firepower Threat Defense Software VPN Web Client Services Cross-Site Scripting Vulnerabilities

Severity

6

CVSS

(AV:N/AC:L/Au:N/C:P/I:P/A:N)

Published

10/23/2024

Created

10/25/2024

Added

10/24/2024

Modified

01/22/2025

Description

A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a browser that is accessing an affected device. This vulnerability is due to improper validation of user-supplied input to application endpoints. An attacker could exploit this vulnerability by persuading a user to follow a link designed to submit malicious input to the affected application. A successful exploit could allow the attacker to execute arbitrary HTML or script code in the browser in the context of the web services page.

Solution(s)

• cisco-asa-update-latest

References

• https://attackerkb.com/topics/cve-2024-20382
• CVE - 2024-20382
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-yjj7ZjVq
• cisco-sa-asaftd-xss-yjj7ZjVq