CVE-2024-20504

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

• CWE-80

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-wsa-sma-xss-zYm3f49nVendor Advisory

Published

Nov 6, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-20499Multiple vulnerabilities in the Cisco AnyConnect VPN server …7.5
• CVE-2024-2050 CWE-79: Improper Neutralization of Input During Web Page Ge…8.2
• CVE-2024-20500A vulnerability in the Cisco AnyConnect VPN server of Cisco …7.5
• CVE-2024-20501Multiple vulnerabilities in the Cisco AnyConnect VPN server …7.5
• CVE-2024-20502A vulnerability in the Cisco AnyConnect VPN server of Cisco …7.5
• CVE-2024-20503A vulnerability in Cisco Duo Epic for Hyperdrive could allow…5.5
• CVE-2024-20505A vulnerability in the PDF parsing module of Clam AntiVirus …7.5
• CVE-2024-20506A vulnerability in the ClamD service module of Clam AntiViru…6.1
• CVE-2024-20507A vulnerability in the logging subsystem of Cisco Meeting Ma…6.5
• CVE-2024-20508A vulnerability in Cisco Unified Threat Defense (UTD) Snort …6.5
• CVE-2024-20509A vulnerability in the Cisco AnyConnect VPN server of Cisco …5.9
• CVE-2024-2051 CWE-307: Improper Restriction of Excessive Authentication A…9.8