Cisco ASA/FTD VPN Web Client Cross-Site Scripting Vulnerabilities (CVE-2024-20341/20382)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Title: Cisco Adaptive Security Appliance and Firepower Threat Defense Software VPN Web Client Services Cross-Site Scripting Vulnerabilities - Vulnerability ID: cisco-sa-asafld-xss-yjj7ZjVq - CVE Numbers: CVE-2024-20341, CVE-2024-20382 - Threat Type: Cross-Site Scripting (XSS) 图 - Affected Scope: Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software - Impact Level: Medium 2. Vulnerability Details: - Cause: Due to improper validation of user-supplied input, remote attackers can exploit these vulnerabilities by tricking users into accessing links containing malicious input, thereby executing cross-site scripting attacks. - Impact: Attackers can execute arbitrary HTML or script code, allowing them to run code within the context of the affected device's browser. 3. Remediation: - Fix Released: Cisco has released software updates to address these vulnerabilities. - Workarounds: No workarounds are available. 4. Affected Products: - ASA Software: ASA software configured with Cisco AnyConnect VPN or Clientless SSL VPN. - FTD Software: FTD software configured with Cisco AnyConnect VPN. 5. Configuration Check: - ASA Software: Use the command to check for affected configurations. - FTD Software: Use the command to check for affected configurations. 6. Products Not Affected: - Cisco FMC software is not affected by these vulnerabilities. 7. Source: - Reporters: Amit Laish and Eedo Shapira (GE Vernova). - Discoverer: Arunesh Shukla (Cisco). 8. Resources: - Link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asafld-xss-yjj7ZjVq This information provides a detailed description of the vulnerability, its scope of impact, remediation steps, and a list of affected products.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco ASA/FTD VPN Web Client Cross-Site Scripting Vulnerabilities (CVE-2024-20341/20382)