CVE-2024-20367 - Vulnerability Details - OpenCVE

A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Cisco	Enterprise Chat And Email

Configuration 1 [-]

OR	cpe:2.3:a:cisco:enterprise_chat_and_email::::::::
	cpe:2.3:a:cisco:enterprise_chat_and_email::::::::

No data.

References

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-xss-CSQxgxfM

History

Wed, 07 May 2025 16:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Cisco Cisco enterprise Chat And Email
CPEs		cpe:2.3:a:cisco:enterprise_chat_and_email::::::::
Vendors & Products		Cisco Cisco enterprise Chat And Email

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2024-04-03T16:22:22.902Z

Updated: 2024-08-01T21:59:42.019Z

Reserved: 2023-11-08T15:08:07.653Z

Link: CVE-2024-20367

Vulnrichment

Updated: 2024-08-01T21:59:42.019Z

NVD

Status : Analyzed

Published: 2024-04-03T17:15:49.907

Modified: 2025-05-07T16:17:08.593

Link: CVE-2024-20367

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-20367", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2023-11-08T15:08:07.653Z", "datePublished": "2024-04-03T16:22:22.902Z", "dateUpdated": "2024-08-01T21:59:42.019Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-04-03T16:22:22.902Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.\r\n\r This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials."}], "affected": [{"vendor": "Cisco", "product": "Cisco Enterprise Chat and Email", "versions": [{"version": "11.5(1)", "status": "affected"}, {"version": "11.6(1)", "status": "affected"}, {"version": "11.6(1)_ES2", "status": "affected"}, {"version": "11.6(1)_ES3", "status": "affected"}, {"version": "11.6(1)_ES4", "status": "affected"}, {"version": "11.6(1)_ES5", "status": "affected"}, {"version": "11.6(1)_ES6", "status": "affected"}, {"version": "11.6(1)_ES10", "status": "affected"}, {"version": "11.6(1)_ES11", "status": "affected"}, {"version": "11.6(1)_ES7", "status": "affected"}, {"version": "11.6(1)_ES8", "status": "affected"}, {"version": "11.6(1)_ES9", "status": "affected"}, {"version": "11.6(1)_ES9a", "status": "affected"}, {"version": "11.6(1)_ES12", "status": "affected"}, {"version": "12.0(1)", "status": "affected"}, {"version": "12.0(1)_ES1", "status": "affected"}, {"version": "12.0(1)_ES2", "status": "affected"}, {"version": "12.0(1)_ES3", "status": "affected"}, {"version": "12.0(1)_ES4", "status": "affected"}, {"version": "12.0(1)_ES5", "status": "affected"}, {"version": "12.0(1)_ES5a", "status": "affected"}, {"version": "12.0(1)_ES6", "status": "affected"}, {"version": "12.0(1)_ES6_ET1", "status": "affected"}, {"version": "12.0(1)_ES6_ET2", "status": "affected"}, {"version": "12.0(1)_ES6_ET3", "status": "affected"}, {"version": "12.0(1)_ES7", "status": "affected"}, {"version": "12.0(1)_ES7_ET1", "status": "affected"}, {"version": "12.5(1)", "status": "affected"}, {"version": "12.5(1)_ES1", "status": "affected"}, {"version": "12.5(1)_ES2", "status": "affected"}, {"version": "12.5(1)_ES3", "status": "affected"}, {"version": "12.5(1)_ES3_ET1", "status": "affected"}, {"version": "12.5(1)_ET1", "status": "affected"}, {"version": "12.5(1)_ES4", "status": "affected"}, {"version": "12.5(1)_ES3_ET2", "status": "affected"}, {"version": "12.5(1)_ES4_ET1", "status": "affected"}, {"version": "12.5(1)_ES5", "status": "affected"}, {"version": "12.5(1)_ES5_ET1", "status": "affected"}, {"version": "12.5(1)_ES6", "status": "affected"}, {"version": "12.5(1)_ES7", "status": "affected"}, {"version": "12.5(1)_ES8", "status": "affected"}, {"version": "12.6(1)", "status": "affected"}, {"version": "12.6(1)_ET1", "status": "affected"}, {"version": "12.6(1)_ET2", "status": "affected"}, {"version": "12.6(1)_ES1", "status": "affected"}, {"version": "12.6(1)_ET3", "status": "affected"}, {"version": "12.6(1)_ES1_ET1", "status": "affected"}, {"version": "12.6(1)_ES2", "status": "affected"}, {"version": "12.6(1)_ES3", "status": "affected"}, {"version": "12.6(1)_ES4", "status": "affected"}, {"version": "12.6(1)_ES4_ET1", "status": "affected"}, {"version": "12.6(1)_ES5", "status": "affected"}, {"version": "12.6(1)_ES5_ET1", "status": "affected"}, {"version": "12.6(1)_ES5_ET2", "status": "affected"}, {"version": "12.6(1)_ES6", "status": "affected"}, {"version": "12.6(1)_ES6_ET1", "status": "affected"}, {"version": "12.6(1)_ES6_ET2", "status": "affected"}, {"version": "12.6_ES2_ET1", "status": "affected"}, {"version": "12.6_ES2_ET2", "status": "affected"}, {"version": "12.6_ES2_ET3", "status": "affected"}, {"version": "12.6_ES2_ET4", "status": "affected"}, {"version": "12.6_ES3_ET1", "status": "affected"}, {"version": "12.6_ES3_ET2", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "cwe", "cweId": "CWE-79"}]}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-xss-CSQxgxfM", "name": "cisco-sa-ece-xss-CSQxgxfM"}], "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-ece-xss-CSQxgxfM", "discovery": "EXTERNAL", "defects": ["CSCwi28527"]}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-20367", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-03T19:09:37.153152Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:40:29.581Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:59:42.019Z"}, "title": "CVE Program Container", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-xss-CSQxgxfM", "name": "cisco-sa-ece-xss-CSQxgxfM", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-xss-CSQxgxfM", "name": "cisco-sa-ece-xss-CSQxgxfM", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:59:42.019Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-20367", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-03T19:09:37.153152Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:21.853Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"source": {"defects": ["CSCwi28527"], "advisory": "cisco-sa-ece-xss-CSQxgxfM", "discovery": "EXTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Cisco", "product": "Cisco Enterprise Chat and Email", "versions": [{"status": "affected", "version": "11.5(1)"}, {"status": "affected", "version": "11.6(1)"}, {"status": "affected", "version": "11.6(1)_ES2"}, {"status": "affected", "version": "11.6(1)_ES3"}, {"status": "affected", "version": "11.6(1)_ES4"}, {"status": "affected", "version": "11.6(1)_ES5"}, {"status": "affected", "version": "11.6(1)_ES6"}, {"status": "affected", "version": "11.6(1)_ES10"}, {"status": "affected", "version": "11.6(1)_ES11"}, {"status": "affected", "version": "11.6(1)_ES7"}, {"status": "affected", "version": "11.6(1)_ES8"}, {"status": "affected", "version": "11.6(1)_ES9"}, {"status": "affected", "version": "11.6(1)_ES9a"}, {"status": "affected", "version": "11.6(1)_ES12"}, {"status": "affected", "version": "12.0(1)"}, {"status": "affected", "version": "12.0(1)_ES1"}, {"status": "affected", "version": "12.0(1)_ES2"}, {"status": "affected", "version": "12.0(1)_ES3"}, {"status": "affected", "version": "12.0(1)_ES4"}, {"status": "affected", "version": "12.0(1)_ES5"}, {"status": "affected", "version": "12.0(1)_ES5a"}, {"status": "affected", "version": "12.0(1)_ES6"}, {"status": "affected", "version": "12.0(1)_ES6_ET1"}, {"status": "affected", "version": "12.0(1)_ES6_ET2"}, {"status": "affected", "version": "12.0(1)_ES6_ET3"}, {"status": "affected", "version": "12.0(1)_ES7"}, {"status": "affected", "version": "12.0(1)_ES7_ET1"}, {"status": "affected", "version": "12.5(1)"}, {"status": "affected", "version": "12.5(1)_ES1"}, {"status": "affected", "version": "12.5(1)_ES2"}, {"status": "affected", "version": "12.5(1)_ES3"}, {"status": "affected", "version": "12.5(1)_ES3_ET1"}, {"status": "affected", "version": "12.5(1)_ET1"}, {"status": "affected", "version": "12.5(1)_ES4"}, {"status": "affected", "version": "12.5(1)_ES3_ET2"}, {"status": "affected", "version": "12.5(1)_ES4_ET1"}, {"status": "affected", "version": "12.5(1)_ES5"}, {"status": "affected", "version": "12.5(1)_ES5_ET1"}, {"status": "affected", "version": "12.5(1)_ES6"}, {"status": "affected", "version": "12.5(1)_ES7"}, {"status": "affected", "version": "12.5(1)_ES8"}, {"status": "affected", "version": "12.6(1)"}, {"status": "affected", "version": "12.6(1)_ET1"}, {"status": "affected", "version": "12.6(1)_ET2"}, {"status": "affected", "version": "12.6(1)_ES1"}, {"status": "affected", "version": "12.6(1)_ET3"}, {"status": "affected", "version": "12.6(1)_ES1_ET1"}, {"status": "affected", "version": "12.6(1)_ES2"}, {"status": "affected", "version": "12.6(1)_ES3"}, {"status": "affected", "version": "12.6(1)_ES4"}, {"status": "affected", "version": "12.6(1)_ES4_ET1"}, {"status": "affected", "version": "12.6(1)_ES5"}, {"status": "affected", "version": "12.6(1)_ES5_ET1"}, {"status": "affected", "version": "12.6(1)_ES5_ET2"}, {"status": "affected", "version": "12.6(1)_ES6"}, {"status": "affected", "version": "12.6(1)_ES6_ET1"}, {"status": "affected", "version": "12.6(1)_ES6_ET2"}, {"status": "affected", "version": "12.6_ES2_ET1"}, {"status": "affected", "version": "12.6_ES2_ET2"}, {"status": "affected", "version": "12.6_ES2_ET3"}, {"status": "affected", "version": "12.6_ES2_ET4"}, {"status": "affected", "version": "12.6_ES3_ET1"}, {"status": "affected", "version": "12.6_ES3_ET2"}]}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-xss-CSQxgxfM", "name": "cisco-sa-ece-xss-CSQxgxfM"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.\r\n\r This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-04-03T16:22:22.902Z"}}}, "cveMetadata": {"cveId": "CVE-2024-20367", "state": "PUBLISHED", "dateUpdated": "2024-08-01T21:59:42.019Z", "dateReserved": "2023-11-08T15:08:07.653Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2024-04-03T16:22:22.902Z", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:enterprise_chat_and_email:*:*:*:*:*:*:*:*", "matchCriteriaId": "1E14B0D4-94D7-4E4C-92D1-63FD4758F2B5", "versionEndExcluding": "12.5(1)es9", "versionStartIncluding": "12.5(1)", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:enterprise_chat_and_email:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C9D2406-C494-4A5A-A820-B95B507633D9", "versionEndExcluding": "12.6(1)es7", "versionStartIncluding": "12.6(1)", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.\r\n\r This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz de usuario web de Cisco Enterprise Chat and Email (ECE) podr\u00eda permitir que un atacante remoto autenticado lleve a cabo un ataque de Cross Site Scripting (XSS) contra un usuario de la interfaz. Esta vulnerabilidad existe porque la interfaz de usuario web no valida correctamente la entrada proporcionada por el usuario. Un atacante podr\u00eda aprovechar esta vulnerabilidad persuadiendo a un usuario de la interfaz para que haga clic en un enlace manipulado. Un exploit exitoso podr\u00eda permitir al atacante ejecutar c\u00f3digo de script arbitrario en el contexto de la interfaz afectada o acceder a informaci\u00f3n confidencial basada en el navegador. Para explotar con \u00e9xito esta vulnerabilidad, un atacante necesitar\u00eda credenciales de agente v\u00e1lidas."}], "id": "CVE-2024-20367", "lastModified": "2025-05-07T16:17:08.593", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "[email protected]", "type": "Primary"}]}, "published": "2024-04-03T17:15:49.907", "references": [{"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-xss-CSQxgxfM"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-xss-CSQxgxfM"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "[email protected]", "type": "Primary"}]}