Description
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Cisco Cisco Secure Email
Default version status: unknown
14.0.0-698affected14.2.0-620affected14.2.1-020affected14.3.0-032affected15.0.0-104affected15.0.1-030affected15.5.0-048affected15.5.1-055affected
Cisco Cisco Secure Email and Web Manager
Default version status: unknown
14.0.0-404affected14.1.0-223affected14.1.0-227affected14.2.0-212affected14.2.0-224affected14.2.1-020affected14.3.0-120affected15.0.0-334affected15.5.1-024affected15.5.1-029affected
Cisco Cisco Secure Web Appliance
Default version status: unknown
14.1.0-032affected14.1.0-047affected14.1.0-041affected14.0.2-012affected14.5.0-498affected14.0.3-014affected14.0.4-005affected14.5.1-008affected14.5.1-016affected15.0.0-355affected15.0.0-322affected15.1.0-287affected14.5.2-011affected15.2.0-116affected14.0.5-007affected15.2.0-164affected14.5.1-510affected14.5.1-607affected14.5.3-033affected