CVE-2024-20367

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-20367", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2023-11-08T15:08:07.653Z", "datePublished": "2024-04-03T16:22:22.902Z", "dateUpdated": "2024-08-01T21:59:42.019Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-04-03T16:22:22.902Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.\r\n\r This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials."}], "affected": [{"vendor": "Cisco", "product": "Cisco Enterprise Chat and Email", "versions": [{"version": "11.5(1)", "status": "affected"}, {"version": "11.6(1)", "status": "affected"}, {"version": "11.6(1)_ES2", "status": "affected"}, {"version": "11.6(1)_ES3", "status": "affected"}, {"version": "11.6(1)_ES4", "status": "affected"}, {"version": "11.6(1)_ES5", "status": "affected"}, {"version": "11.6(1)_ES6", "status": "affected"}, {"version": "11.6(1)_ES10", "status": "affected"}, {"version": "11.6(1)_ES11", "status": "affected"}, {"version": "11.6(1)_ES7", "status": "affected"}, {"version": "11.6(1)_ES8", "status": "affected"}, {"version": "11.6(1)_ES9", "status": "affected"}, {"version": "11.6(1)_ES9a", "status": "affected"}, {"version": "11.6(1)_ES12", "status": "affected"}, {"version": "12.0(1)", "status": "affected"}, {"version": "12.0(1)_ES1", "status": "affected"}, {"version": "12.0(1)_ES2", "status": "affected"}, {"version": "12.0(1)_ES3", "status": "affected"}, {"version": "12.0(1)_ES4", "status": "affected"}, {"version": "12.0(1)_ES5", "status": "affected"}, {"version": "12.0(1)_ES5a", "status": "affected"}, {"version": "12.0(1)_ES6", "status": "affected"}, {"version": "12.0(1)_ES6_ET1", "status": "affected"}, {"version": "12.0(1)_ES6_ET2", "status": "affected"}, {"version": "12.0(1)_ES6_ET3", "status": "affected"}, {"version": "12.0(1)_ES7", "status": "affected"}, {"version": "12.0(1)_ES7_ET1", "status": "affected"}, {"version": "12.5(1)", "status": "affected"}, {"version": "12.5(1)_ES1", "status": "affected"}, {"version": "12.5(1)_ES2", "status": "affected"}, {"version": "12.5(1)_ES3", "status": "affected"}, {"version": "12.5(1)_ES3_ET1", "status": "affected"}, {"version": "12.5(1)_ET1", "status": "affected"}, {"version": "12.5(1)_ES4", "status": "affected"}, {"version": "12.5(1)_ES3_ET2", "status": "affected"}, {"version": "12.5(1)_ES4_ET1", "status": "affected"}, {"version": "12.5(1)_ES5", "status": "affected"}, {"version": "12.5(1)_ES5_ET1", "status": "affected"}, {"version": "12.5(1)_ES6", "status": "affected"}, {"version": "12.5(1)_ES7", "status": "affected"}, {"version": "12.5(1)_ES8", "status": "affected"}, {"version": "12.6(1)", "status": "affected"}, {"version": "12.6(1)_ET1", "status": "affected"}, {"version": "12.6(1)_ET2", "status": "affected"}, {"version": "12.6(1)_ES1", "status": "affected"}, {"version": "12.6(1)_ET3", "status": "affected"}, {"version": "12.6(1)_ES1_ET1", "status": "affected"}, {"version": "12.6(1)_ES2", "status": "affected"}, {"version": "12.6(1)_ES3", "status": "affected"}, {"version": "12.6(1)_ES4", "status": "affected"}, {"version": "12.6(1)_ES4_ET1", "status": "affected"}, {"version": "12.6(1)_ES5", "status": "affected"}, {"version": "12.6(1)_ES5_ET1", "status": "affected"}, {"version": "12.6(1)_ES5_ET2", "status": "affected"}, {"version": "12.6(1)_ES6", "status": "affected"}, {"version": "12.6(1)_ES6_ET1", "status": "affected"}, {"version": "12.6(1)_ES6_ET2", "status": "affected"}, {"version": "12.6_ES2_ET1", "status": "affected"}, {"version": "12.6_ES2_ET2", "status": "affected"}, {"version": "12.6_ES2_ET3", "status": "affected"}, {"version": "12.6_ES2_ET4", "status": "affected"}, {"version": "12.6_ES3_ET1", "status": "affected"}, {"version": "12.6_ES3_ET2", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "cwe", "cweId": "CWE-79"}]}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-xss-CSQxgxfM", "name": "cisco-sa-ece-xss-CSQxgxfM"}], "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-ece-xss-CSQxgxfM", "discovery": "EXTERNAL", "defects": ["CSCwi28527"]}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-20367", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-03T19:09:37.153152Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:40:29.581Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:59:42.019Z"}, "title": "CVE Program Container", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-xss-CSQxgxfM", "name": "cisco-sa-ece-xss-CSQxgxfM", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-xss-CSQxgxfM", "name": "cisco-sa-ece-xss-CSQxgxfM", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:59:42.019Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-20367", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-03T19:09:37.153152Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:21.853Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"source": {"defects": ["CSCwi28527"], "advisory": "cisco-sa-ece-xss-CSQxgxfM", "discovery": "EXTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Cisco", "product": "Cisco Enterprise Chat and Email", "versions": [{"status": "affected", "version": "11.5(1)"}, {"status": "affected", "version": "11.6(1)"}, {"status": "affected", "version": "11.6(1)_ES2"}, {"status": "affected", "version": "11.6(1)_ES3"}, {"status": "affected", "version": "11.6(1)_ES4"}, {"status": "affected", "version": "11.6(1)_ES5"}, {"status": "affected", "version": "11.6(1)_ES6"}, {"status": "affected", "version": "11.6(1)_ES10"}, {"status": "affected", "version": "11.6(1)_ES11"}, {"status": "affected", "version": "11.6(1)_ES7"}, {"status": "affected", "version": "11.6(1)_ES8"}, {"status": "affected", "version": "11.6(1)_ES9"}, {"status": "affected", "version": "11.6(1)_ES9a"}, {"status": "affected", "version": "11.6(1)_ES12"}, {"status": "affected", "version": "12.0(1)"}, {"status": "affected", "version": "12.0(1)_ES1"}, {"status": "affected", "version": "12.0(1)_ES2"}, {"status": "affected", "version": "12.0(1)_ES3"}, {"status": "affected", "version": "12.0(1)_ES4"}, {"status": "affected", "version": "12.0(1)_ES5"}, {"status": "affected", "version": "12.0(1)_ES5a"}, {"status": "affected", "version": "12.0(1)_ES6"}, {"status": "affected", "version": "12.0(1)_ES6_ET1"}, {"status": "affected", "version": "12.0(1)_ES6_ET2"}, {"status": "affected", "version": "12.0(1)_ES6_ET3"}, {"status": "affected", "version": "12.0(1)_ES7"}, {"status": "affected", "version": "12.0(1)_ES7_ET1"}, {"status": "affected", "version": "12.5(1)"}, {"status": "affected", "version": "12.5(1)_ES1"}, {"status": "affected", "version": "12.5(1)_ES2"}, {"status": "affected", "version": "12.5(1)_ES3"}, {"status": "affected", "version": "12.5(1)_ES3_ET1"}, {"status": "affected", "version": "12.5(1)_ET1"}, {"status": "affected", "version": "12.5(1)_ES4"}, {"status": "affected", "version": "12.5(1)_ES3_ET2"}, {"status": "affected", "version": "12.5(1)_ES4_ET1"}, {"status": "affected", "version": "12.5(1)_ES5"}, {"status": "affected", "version": "12.5(1)_ES5_ET1"}, {"status": "affected", "version": "12.5(1)_ES6"}, {"status": "affected", "version": "12.5(1)_ES7"}, {"status": "affected", "version": "12.5(1)_ES8"}, {"status": "affected", "version": "12.6(1)"}, {"status": "affected", "version": "12.6(1)_ET1"}, {"status": "affected", "version": "12.6(1)_ET2"}, {"status": "affected", "version": "12.6(1)_ES1"}, {"status": "affected", "version": "12.6(1)_ET3"}, {"status": "affected", "version": "12.6(1)_ES1_ET1"}, {"status": "affected", "version": "12.6(1)_ES2"}, {"status": "affected", "version": "12.6(1)_ES3"}, {"status": "affected", "version": "12.6(1)_ES4"}, {"status": "affected", "version": "12.6(1)_ES4_ET1"}, {"status": "affected", "version": "12.6(1)_ES5"}, {"status": "affected", "version": "12.6(1)_ES5_ET1"}, {"status": "affected", "version": "12.6(1)_ES5_ET2"}, {"status": "affected", "version": "12.6(1)_ES6"}, {"status": "affected", "version": "12.6(1)_ES6_ET1"}, {"status": "affected", "version": "12.6(1)_ES6_ET2"}, {"status": "affected", "version": "12.6_ES2_ET1"}, {"status": "affected", "version": "12.6_ES2_ET2"}, {"status": "affected", "version": "12.6_ES2_ET3"}, {"status": "affected", "version": "12.6_ES2_ET4"}, {"status": "affected", "version": "12.6_ES3_ET1"}, {"status": "affected", "version": "12.6_ES3_ET2"}]}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-xss-CSQxgxfM", "name": "cisco-sa-ece-xss-CSQxgxfM"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.\r\n\r This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-04-03T16:22:22.902Z"}}}, "cveMetadata": {"cveId": "CVE-2024-20367", "state": "PUBLISHED", "dateUpdated": "2024-08-01T21:59:42.019Z", "dateReserved": "2023-11-08T15:08:07.653Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2024-04-03T16:22:22.902Z", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Cisco Enterprise Chat and Email", "vendor": "Cisco", "versions": [{"status": "affected", "version": "11.5(1)"}, {"status": "affected", "version": "11.6(1)"}, {"status": "affected", "version": "11.6(1)_ES2"}, {"status": "affected", "version": "11.6(1)_ES3"}, {"status": "affected", "version": "11.6(1)_ES4"}, {"status": "affected", "version": "11.6(1)_ES5"}, {"status": "affected", "version": "11.6(1)_ES6"}, {"status": "affected", "version": "11.6(1)_ES10"}, {"status": "affected", "version": "11.6(1)_ES11"}, {"status": "affected", "version": "11.6(1)_ES7"}, {"status": "affected", "version": "11.6(1)_ES8"}, {"status": "affected", "version": "11.6(1)_ES9"}, {"status": "affected", "version": "11.6(1)_ES9a"}, {"status": "affected", "version": "11.6(1)_ES12"}, {"status": "affected", "version": "12.0(1)"}, {"status": "affected", "version": "12.0(1)_ES1"}, {"status": "affected", "version": "12.0(1)_ES2"}, {"status": "affected", "version": "12.0(1)_ES3"}, {"status": "affected", "version": "12.0(1)_ES4"}, {"status": "affected", "version": "12.0(1)_ES5"}, {"status": "affected", "version": "12.0(1)_ES5a"}, {"status": "affected", "version": "12.0(1)_ES6"}, {"status": "affected", "version": "12.0(1)_ES6_ET1"}, {"status": "affected", "version": "12.0(1)_ES6_ET2"}, {"status": "affected", "version": "12.0(1)_ES6_ET3"}, {"status": "affected", "version": "12.0(1)_ES7"}, {"status": "affected", "version": "12.0(1)_ES7_ET1"}, {"status": "affected", "version": "12.5(1)"}, {"status": "affected", "version": "12.5(1)_ES1"}, {"status": "affected", "version": "12.5(1)_ES2"}, {"status": "affected", "version": "12.5(1)_ES3"}, {"status": "affected", "version": "12.5(1)_ES3_ET1"}, {"status": "affected", "version": "12.5(1)_ET1"}, {"status": "affected", "version": "12.5(1)_ES4"}, {"status": "affected", "version": "12.5(1)_ES3_ET2"}, {"status": "affected", "version": "12.5(1)_ES4_ET1"}, {"status": "affected", "version": "12.5(1)_ES5"}, {"status": "affected", "version": "12.5(1)_ES5_ET1"}, {"status": "affected", "version": "12.5(1)_ES6"}, {"status": "affected", "version": "12.5(1)_ES7"}, {"status": "affected", "version": "12.5(1)_ES8"}, {"status": "affected", "version": "12.6(1)"}, {"status": "affected", "version": "12.6(1)_ET1"}, {"status": "affected", "version": "12.6(1)_ET2"}, {"status": "affected", "version": "12.6(1)_ES1"}, {"status": "affected", "version": "12.6(1)_ET3"}, {"status": "affected", "version": "12.6(1)_ES1_ET1"}, {"status": "affected", "version": "12.6(1)_ES2"}, {"status": "affected", "version": "12.6(1)_ES3"}, {"status": "affected", "version": "12.6(1)_ES4"}, {"status": "affected", "version": "12.6(1)_ES4_ET1"}, {"status": "affected", "version": "12.6(1)_ES5"}, {"status": "affected", "version": "12.6(1)_ES5_ET1"}, {"status": "affected", "version": "12.6(1)_ES5_ET2"}, {"status": "affected", "version": "12.6(1)_ES6"}, {"status": "affected", "version": "12.6(1)_ES6_ET1"}, {"status": "affected", "version": "12.6(1)_ES6_ET2"}, {"status": "affected", "version": "12.6_ES2_ET1"}, {"status": "affected", "version": "12.6_ES2_ET2"}, {"status": "affected", "version": "12.6_ES2_ET3"}, {"status": "affected", "version": "12.6_ES2_ET4"}, {"status": "affected", "version": "12.6_ES3_ET1"}, {"status": "affected", "version": "12.6_ES3_ET2"}]}], "source": "psirt@cisco.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:enterprise_chat_and_email:*:*:*:*:*:*:*:*", "matchCriteriaId": "1E14B0D4-94D7-4E4C-92D1-63FD4758F2B5", "versionEndExcluding": "12.5(1)es9", "versionStartIncluding": "12.5(1)", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:enterprise_chat_and_email:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C9D2406-C494-4A5A-A820-B95B507633D9", "versionEndExcluding": "12.6(1)es7", "versionStartIncluding": "12.6(1)", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.\r\n\r This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz de usuario web de Cisco Enterprise Chat and Email (ECE) podr\u00eda permitir que un atacante remoto autenticado lleve a cabo un ataque de Cross Site Scripting (XSS) contra un usuario de la interfaz. Esta vulnerabilidad existe porque la interfaz de usuario web no valida correctamente la entrada proporcionada por el usuario. Un atacante podr\u00eda aprovechar esta vulnerabilidad persuadiendo a un usuario de la interfaz para que haga clic en un enlace manipulado. Un exploit exitoso podr\u00eda permitir al atacante ejecutar c\u00f3digo de script arbitrario en el contexto de la interfaz afectada o acceder a informaci\u00f3n confidencial basada en el navegador. Para explotar con \u00e9xito esta vulnerabilidad, un atacante necesitar\u00eda credenciales de agente v\u00e1lidas."}], "id": "CVE-2024-20367", "lastModified": "2026-06-17T07:06:50.663", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "psirt@cisco.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-20367", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-04-03T19:09:37.153152Z", "version": "2.0.3"}}]}, "published": "2024-04-03T17:15:49.907", "references": [{"source": "psirt@cisco.com", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-xss-CSQxgxfM"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-xss-CSQxgxfM"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "psirt@cisco.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}