← Back to browse · API

CVE-2024-20337

Severity
HIGH
CVSS
8.2
EPSS
0.29906
Risk score
43.27
CISA KEV
No
PoC
No
Published
2024-03-06
Modified
2024-08-01
First seen
2026-08-08
Aliases
EUVD-2024-18052, GHSA-J296-JHQ5-3X6C
Products
Cisco:Cisco Secure Client 4.10.00093, Cisco:Cisco Secure Client 4.10.01075, Cisco:Cisco Secure Client 4.10.02086, Cisco:Cisco Secure Client 4.10.03104, Cisco:Cisco Secure Client 4.10.04065, Cisco:Cisco Secure Client 4.10.04071, Cisco:Cisco Secure Client 4.10.05085, Cisco:Cisco Secure Client 4.10.05095, Cisco:Cisco Secure Client 4.10.05111, Cisco:Cisco Secure Client 4.10.06079, Cisco:Cisco Secure Client 4.10.06090, Cisco:Cisco Secure Client 4.10.07061, Cisco:Cisco Secure Client 4.10.07062, Cisco:Cisco Secure Client 4.10.07073, Cisco:Cisco Secure Client 4.9.00086, Cisco:Cisco Secure Client 4.9.01095, Cisco:Cisco Secure Client 4.9.02028, Cisco:Cisco Secure Client 4.9.03047, Cisco:Cisco Secure Client 4.9.03049, Cisco:Cisco Secure Client 4.9.04043, Cisco:Cisco Secure Client 4.9.04053, Cisco:Cisco Secure Client 4.9.05042, Cisco:Cisco Secure Client 4.9.06037, Cisco:Cisco Secure Client 5.0.00238, Cisco:Cisco Secure Client 5.0.00529, Cisco:Cisco Secure Client 5.0.00556, Cisco:Cisco Secure Client 5.0.01242, Cisco:Cisco Secure Client 5.0.02075, Cisco:Cisco Secure Client 5.0.03072, Cisco:Cisco Secure Client 5.0.03076, Cisco:Cisco Secure Client 5.0.04032, Cisco:Cisco Secure Client 5.0.05040, Cisco:Cisco Secure Client 5.1.0.136, Cisco:Cisco Secure Client 5.1.1.42
Sources
euvd EUVD-2024-18052

Description

A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF) injection attack against a user. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link while establishing a VPN session. A successful exploit could allow the attacker to execute arbitrary script code in the browser or access sensitive, browser-based information, including a valid SAML token. The attacker could then use the token to establish a remote access VPN session with the privileges of the affected user. Individual hosts and services behind the VPN headend would still need additional credentials for successful access.

References