Cisco FMC Web UI HTML Injection via Authenticated Access (CVE-2024-20274)
CVE-2024-20274 Published on October 23, 2024
Cisco Secure Firewall Management Center HTML Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Management Center Software, could allow an authenticated, remote attacker to inject arbitrary HTML content into a device-generated document.
This vulnerability is due to improper validation of user-supplied data. An attacker could exploit this vulnerability by submitting malicious content to an affected device and using the device to generate a document that contains sensitive information. A successful exploit could allow the attacker to alter the standard layout of the device-generated documents, access arbitrary files from the underlying operating system, and conduct server-side request forgery (SSRF) attacks. To successfully exploit this vulnerability, an attacker would need valid credentials for a user account with policy-editing permissions, such as Network Admin, Intrusion Admin, or any custom user role with the same capabilities.
Vulnerability Analysis
CVE-2024-20274 is exploitable with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Products Associated with CVE-2024-20274
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-20274 are published in Cisco Secure Firewall Management Center:
Affected Versions
Cisco Firepower Management Center:- Version 6.2.3.12 is affected.
- Version 6.2.3.1 is affected.
- Version 6.2.3.10 is affected.
- Version 6.2.3.8 is affected.
- Version 6.4.0.6 is affected.
- Version 6.2.3 is affected.
- Version 6.4.0.7 is affected.
- Version 6.2.3.13 is affected.
- Version 6.2.3.5 is affected.
- Version 6.4.0.4 is affected.
- Version 6.2.3.9 is affected.
- Version 6.2.3.14 is affected.
- Version 6.4.0.1 is affected.
- Version 6.2.3.6 is affected.
- Version 6.2.3.11 is affected.
- Version 6.4.0.8 is affected.
- Version 6.2.3.2 is affected.
- Version 6.4.0.2 is affected.
- Version 6.2.3.3 is affected.
- Version 6.4.0.3 is affected.
- Version 6.2.3.7 is affected.
- Version 6.2.3.4 is affected.
- Version 6.4.0.5 is affected.
- Version 6.4.0 is affected.
- Version 6.2.3.15 is affected.
- Version 6.6.0 is affected.
- Version 6.4.0.9 is affected.
- Version 6.2.3.16 is affected.
- Version 6.6.0.1 is affected.
- Version 6.6.1 is affected.
- Version 6.4.0.10 is affected.
- Version 6.7.0 is affected.
- Version 6.4.0.11 is affected.
- Version 6.6.3 is affected.
- Version 6.7.0.1 is affected.
- Version 6.6.4 is affected.
- Version 6.4.0.12 is affected.
- Version 6.7.0.2 is affected.
- Version 7.0.0 is affected.
- Version 6.2.3.17 is affected.
- Version 7.0.0.1 is affected.
- Version 6.6.5 is affected.
- Version 7.0.1 is affected.
- Version 7.1.0 is affected.
- Version 6.6.5.1 is affected.
- Version 6.4.0.13 is affected.
- Version 6.7.0.3 is affected.
- Version 7.0.1.1 is affected.
- Version 6.2.3.18 is affected.
- Version 6.4.0.14 is affected.
- Version 6.6.5.2 is affected.
- Version 7.1.0.1 is affected.
- Version 7.0.2 is affected.
- Version 6.4.0.15 is affected.
- Version 7.2.0 is affected.
- Version 7.0.2.1 is affected.
- Version 7.0.3 is affected.
- Version 6.6.7 is affected.
- Version 7.1.0.2 is affected.
- Version 7.2.0.1 is affected.
- Version 7.0.4 is affected.
- Version 7.2.1 is affected.
- Version 7.0.5 is affected.
- Version 6.4.0.16 is affected.
- Version 7.3.0 is affected.
- Version 7.2.2 is affected.
- Version 6.6.7.1 is affected.
- Version 7.3.1 is affected.
- Version 7.2.3 is affected.
- Version 7.1.0.3 is affected.
- Version 7.2.3.1 is affected.
- Version 7.2.4 is affected.
- Version 7.0.6 is affected.
- Version 7.2.4.1 is affected.
- Version 7.2.5 is affected.
- Version 7.3.1.1 is affected.
- Version 7.4.0 is affected.
- Version 6.4.0.17 is affected.
- Version 7.0.6.1 is affected.
- Version 7.2.5.1 is affected.
- Version 7.4.1 is affected.
- Version 7.4.1.1 is affected.
- Version 6.4.0.18 is affected.
- Version 6.6.7.2 is affected.
- Version 7.2.5.2 is affected.
- Version 7.3.1.2 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.