CVE-2024-20337

{"id": "CVE-2024-20337", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.8}]}, "published": "2024-03-06T17:15:09.580", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-client-crlf-W43V4G7", "tags": ["Vendor Advisory"], "source": "psirt@cisco.com"}, {"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-client-crlf-W43V4G7", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-93"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF) injection attack against a user. \r\n\r This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link while establishing a VPN session. A successful exploit could allow the attacker to execute arbitrary script code in the browser or access sensitive, browser-based information, including a valid SAML token. The attacker could then use the token to establish a remote access VPN session with the privileges of the affected user. Individual hosts and services behind the VPN headend would still need additional credentials for successful access."}, {"lang": "es", "value": "Una vulnerabilidad en el proceso de autenticaci\u00f3n SAML de Cisco Secure Client podr\u00eda permitir que un atacante remoto no autenticado lleve a cabo un ataque de inyecci\u00f3n de avance de l\u00ednea de retorno de carro (CRLF) contra un usuario. Esta vulnerabilidad se debe a una validaci\u00f3n insuficiente de la entrada proporcionada por el usuario. Un atacante podr\u00eda aprovechar esta vulnerabilidad persuadiendo a un usuario para que haga clic en un enlace manipulado mientras establece una sesi\u00f3n VPN. Un exploit exitoso podr\u00eda permitir al atacante ejecutar c\u00f3digo de script arbitrario en el navegador o acceder a informaci\u00f3n confidencial basada en el navegador, incluido un token SAML v\u00e1lido. Luego, el atacante podr\u00eda usar el token para establecer una sesi\u00f3n VPN de acceso remoto con los privilegios del usuario afectado. Los hosts y servicios individuales detr\u00e1s de la cabecera VPN a\u00fan necesitar\u00edan credenciales adicionales para un acceso exitoso."}], "lastModified": "2025-07-22T18:00:37.350", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:secure_client:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10933A96-8975-4961-8804-9B75C6D2324B", "versionEndExcluding": "4.10.08025", "versionStartIncluding": "4.10.04065"}, {"criteria": "cpe:2.3:a:cisco:secure_client:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "207CA3FC-560B-470D-9117-0CE73A128BC1", "versionEndExcluding": "5.1.2.42", "versionStartIncluding": "5.0.00529"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@cisco.com"}