XSS in Cisco ASA VPN Web Client Enables Script Execution
CVE-2024-20341 Published on October 23, 2024

Cisco Adaptive Security Appliance WebVPN Cross-Site Scripting Vulnerability
A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a browser that is accessing an affected device. This vulnerability is due to improper validation of user-supplied input to application endpoints. An attacker could exploit this vulnerability by persuading a user to follow a link designed to submit malicious input to the affected application. A successful exploit could allow the attacker to execute arbitrary HTML or script code in the browser in the context of the web services page.

NVD

Vulnerability Analysis

CVE-2024-20341 can be exploited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
CHANGED
Confidentiality Impact:
LOW
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Type

What is a Basic XSS Vulnerability?

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. This may allow such characters to be treated as control characters, which are executed client-side in the context of the user's session. Although this can be classified as an injection problem, the more pertinent issue is the improper conversion of such special characters to respective context-appropriate entities before displaying them to the user.

CVE-2024-20341 has been classified to as a Basic XSS vulnerability or weakness.


Products Associated with CVE-2024-20341

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-20341 are published in these products:

Cisco Adaptive Security Appliance Software
 
Cisco Firepower Threat Defense Software
 
Cisco Adaptive Security Appliance
 

Affected Versions

Cisco Adaptive Security Appliance (ASA) Software: Cisco Firepower Threat Defense Software:

Exploit Probability

EPSS
0.25%
Percentile
48.47%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.