Main Vulnerability Database Vulnerabilities #VU99325

Cross-site scripting in Cisco Secure Firewall Threat Defense (FTD) and Cisco Secure Firewall Adaptive Security Appliance (ASA) - CVE-2024-20341

Published: October 24, 2024

Vulnerability identifier: #VU99325

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2024-20341

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the VPN web client services feature. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Affected software

Cisco Secure Firewall Threat Defense (FTD)
Cisco Secure Firewall Adaptive Security Appliance (ASA)

How to mitigate CVE-2024-20341

Install updates from vendor's website.

Cisco Secure Firewall Threat Defense (FTD) - addressed in versions 6.4.0.18, 7.0.6.2, 7.0.6.3, 7.2.6, 7.2.7, 7.2.8, 7.2.8.1, 7.2.9, 7.4.2, 7.4.2.1, 7.6.0, 9.12.4.67, 9.16.4.55, 9.16.4.57, 9.16.4.61, 9.16.4.62, 9.16.4.67, 9.16.4.70, 9.16.4.71, 9.17.1.39, 9.17.1.45, 9.18.4.22, 9.18.4.24, 9.18.4.29, 9.18.4.34, 9.18.4.40, 9.18.4.47, 9.19.1.28, 9.19.1.31, 9.19.1.37, 9.20.2.10, 9.20.2.21, 9.20.2.22, 9.20.3, 9.20.3.4, 9.20.3.7, 9.22.1.1
Cisco Secure Firewall Adaptive Security Appliance (ASA) - addressed in versions 6.4.0.18, 7.0.6.2, 7.0.6.3, 7.2.6, 7.2.7, 7.2.8, 7.2.8.1, 7.2.9, 7.4.2, 7.4.2.1, 7.6.0, 9.12.4.67, 9.16.4.55, 9.16.4.57, 9.16.4.61, 9.16.4.62, 9.16.4.67, 9.16.4.70, 9.16.4.71, 9.17.1.39, 9.17.1.45, 9.18.4.22, 9.18.4.24, 9.18.4.29, 9.18.4.34, 9.18.4.40, 9.18.4.47, 9.19.1.28, 9.19.1.31, 9.19.1.37, 9.20.2.10, 9.20.2.21, 9.20.2.22, 9.20.3, 9.20.3.4, 9.20.3.7, 9.22.1.1

External References

Related Security Bulletins