description: A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, formerly known as Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
problem types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
vendor: Cisco
product: Cisco Secure Email and Web Manager
versions:
version: 11.0.0-115, status: affected
version: 11.0.1-161, status: affected
version: 11.5.1-105, status: affected
version: 12.0.0-452, status: affected
version: 12.0.1-011, status: affected
version: 12.5.0-636, status: affected
version: 12.5.0-658, status: affected
version: 12.5.0-678, status: affected
version: 12.5.0-670, status: affected
version: 13.0.0-277, status: affected
version: 13.6.2-078, status: affected
version: 13.8.1-068, status: affected
version: 13.8.1-074, status: affected
version: 13.8.1-108, status: affected
version: 12.8.1-002, status: affected
version: 12.8.1-021, status: affected
version: 14.0.0-404, status: affected
version: 14.1.0-223, status: affected
version: 14.1.0-227, status: affected
version: 14.2.0-212, status: affected
version: 14.2.0-224, status: affected
version: 14.2.1-020, status: affected
version: 14.3.0-120, status: affected
}
metrics:
format: cvssV3_1
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
]
exploits: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that is described in this advisory.