Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, formerly Cisco Email Security Appliance (ESA); and Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow a remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities, see the Details section of this advisory.
References
| Link | Resource |
|---|---|
| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-xss-cP9DuEmq | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
07 Jul 2023, 13:11
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:cisco:web_security_appliance:14.0.0-418:*:*:*:*:*:*:* cpe:2.3:a:cisco:web_security_appliance:15.0.0-256:*:*:*:*:*:*:* cpe:2.3:a:cisco:secure_email_and_web_manager:14.0.1-053:*:*:*:*:*:*:* cpe:2.3:a:cisco:secure_email_and_web_manager:14.0.0-418:*:*:*:*:*:*:* cpe:2.3:a:cisco:web_security_appliance:15.0.0-050:*:*:*:*:*:*:* cpe:2.3:a:cisco:secure_email_gateway:14.0.1-053:*:*:*:*:*:*:* cpe:2.3:a:cisco:secure_email_gateway:15.0.0-050:*:*:*:*:*:*:* cpe:2.3:a:cisco:web_security_appliance:14.0.1-033:*:*:*:*:*:*:* cpe:2.3:a:cisco:web_security_appliance:14.0.1-053:*:*:*:*:*:*:* cpe:2.3:a:cisco:secure_email_and_web_manager:15.0.0-256:*:*:*:*:*:*:* cpe:2.3:a:cisco:secure_email_and_web_manager:14.0.1-033:*:*:*:*:*:*:* cpe:2.3:a:cisco:secure_email_and_web_manager:15.0.0-050:*:*:*:*:*:*:* cpe:2.3:a:cisco:secure_email_gateway:15.0.0-256:*:*:*:*:*:*:* cpe:2.3:a:cisco:secure_email_gateway:14.0.1-033:*:*:*:*:*:*:* cpe:2.3:a:cisco:secure_email_gateway:14.0.0-418:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| References | (CISCO) https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-xss-cP9DuEmq - Vendor Advisory | |
| CWE | CWE-79 | |
| First Time |
Cisco secure Email And Web Manager
Cisco web Security Appliance Cisco secure Email Gateway Cisco |
28 Jun 2023, 15:25
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-28 15:15
Updated : 2023-12-10 15:01
NVD link : CVE-2023-20028
Mitre link : CVE-2023-20028
CVE.ORG link : CVE-2023-20028
JSON object : View
Products Affected
cisco
- secure_email_and_web_manager
- secure_email_gateway
- web_security_appliance
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')