CVE-2024-20298
Cisco Firepower Management Center Software Cross-Site Scripting Vulnerability
Reported by cisco · Published October 23, 2024
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by inserting crafted input into various data fields in an affected interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface, or access sensitive, browser-based information.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Firepower Management Center | 7.3.0, 7.3.1, 7.3.1.1 |
| Cisco | Cisco Firepower Management Center | 7.3.0, 7.3.1, 7.4.1 |
Timeline
- Oct 23, 2024 Coalition ESS Score (10 in total, the first dated here)
- Oct 23, 2024 CVE Published
- Oct 23, 2024 PoC Published
- Oct 24, 2024 EPSS Score (30 in total, the first dated here)
- Oct 24, 2024 CVE Updated
- Jun 2, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2024-20298
vulnetix vdb fixes CVE-2024-20298Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-20298/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart