CVE-2024-20388

MEDIUM EPSS 35.3%
Published Oct 23, 20241y ago · Modified Jun 17, 20261w ago
5.3 CVSS 3.1
Medium
Find Similar
Published Oct 23, 2024 1y ago
Last Modified Jun 17, 2026 1w ago

Description

A vulnerability in the password change feature of Cisco Firepower Management Center (FMC) software could allow an unauthenticated, remote attacker to determine valid user names on an affected device. This vulnerability is due to improper authentication of password update responses. An attacker could exploit this vulnerability by forcing a password reset on an affected device. A successful exploit could allow the attacker to determine valid user names in the unauthenticated response to a forced password reset.

CVSS Details

Base Score
5.3
Exploitability
3.9
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
35.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-202

Affected Products 104

VendorProductVersionRange
ciscofirepower_management_center6.4.0.17any
ciscofirepower_management_center6.4.0.18any
ciscofirepower_management_center6.6.7.2any
ciscofirepower_management_center7.0.6.1any
ciscofirepower_management_center7.0.6.2any
ciscofirepower_management_center7.2.5.1any
ciscofirepower_management_center7.2.5.2any
ciscofirepower_management_center7.2.6any
ciscofirepower_management_center7.2.7any
ciscofirepower_management_center7.2.8any
ciscofirepower_management_center7.2.8.1any
ciscofirepower_management_center7.4.0any
ciscofirepower_management_center7.4.1any
ciscofirepower_management_center7.4.1.1any
ciscosecure_firewall_management_center6.2.3any
ciscosecure_firewall_management_center6.2.3.1any
ciscosecure_firewall_management_center6.2.3.2any
ciscosecure_firewall_management_center6.2.3.3any
ciscosecure_firewall_management_center6.2.3.4any
ciscosecure_firewall_management_center6.2.3.5any
ciscosecure_firewall_management_center6.2.3.6any
ciscosecure_firewall_management_center6.2.3.7any
ciscosecure_firewall_management_center6.2.3.8any
ciscosecure_firewall_management_center6.2.3.9any
ciscosecure_firewall_management_center6.2.3.10any
ciscosecure_firewall_management_center6.2.3.11any
ciscosecure_firewall_management_center6.2.3.12any
ciscosecure_firewall_management_center6.2.3.13any
ciscosecure_firewall_management_center6.2.3.14any
ciscosecure_firewall_management_center6.2.3.15any
ciscosecure_firewall_management_center6.2.3.16any
ciscosecure_firewall_management_center6.2.3.17any
ciscosecure_firewall_management_center6.2.3.18any
ciscosecure_firewall_management_center6.4.0any
ciscosecure_firewall_management_center6.4.0.1any
ciscosecure_firewall_management_center6.4.0.2any
ciscosecure_firewall_management_center6.4.0.3any
ciscosecure_firewall_management_center6.4.0.4any
ciscosecure_firewall_management_center6.4.0.5any
ciscosecure_firewall_management_center6.4.0.6any
ciscosecure_firewall_management_center6.4.0.7any
ciscosecure_firewall_management_center6.4.0.8any
ciscosecure_firewall_management_center6.4.0.9any
ciscosecure_firewall_management_center6.4.0.10any
ciscosecure_firewall_management_center6.4.0.11any
ciscosecure_firewall_management_center6.4.0.12any
ciscosecure_firewall_management_center6.4.0.13any
ciscosecure_firewall_management_center6.4.0.14any
ciscosecure_firewall_management_center6.4.0.15any
ciscosecure_firewall_management_center6.4.0.16any
ciscosecure_firewall_management_center6.6.0any
ciscosecure_firewall_management_center6.6.0.1any
ciscosecure_firewall_management_center6.6.1any
ciscosecure_firewall_management_center6.6.3any
ciscosecure_firewall_management_center6.6.4any
ciscosecure_firewall_management_center6.6.5any
ciscosecure_firewall_management_center6.6.5.1any
ciscosecure_firewall_management_center6.6.5.2any
ciscosecure_firewall_management_center6.6.7any
ciscosecure_firewall_management_center6.6.7.1any
ciscosecure_firewall_management_center6.7.0any
ciscosecure_firewall_management_center6.7.0.1any
ciscosecure_firewall_management_center6.7.0.2any
ciscosecure_firewall_management_center6.7.0.3any
ciscosecure_firewall_management_center7.0.0any
ciscosecure_firewall_management_center7.0.0.1any
ciscosecure_firewall_management_center7.0.1any
ciscosecure_firewall_management_center7.0.1.1any
ciscosecure_firewall_management_center7.0.2any
ciscosecure_firewall_management_center7.0.2.1any
ciscosecure_firewall_management_center7.0.3any
ciscosecure_firewall_management_center7.0.4any
ciscosecure_firewall_management_center7.0.5any
ciscosecure_firewall_management_center7.0.6any
ciscosecure_firewall_management_center7.1.0any
ciscosecure_firewall_management_center7.1.0.1any
ciscosecure_firewall_management_center7.1.0.2any
ciscosecure_firewall_management_center7.1.0.3any
ciscosecure_firewall_management_center7.2.0any
ciscosecure_firewall_management_center7.2.0.1any
ciscosecure_firewall_management_center7.2.1any
ciscosecure_firewall_management_center7.2.2any
ciscosecure_firewall_management_center7.2.3any
ciscosecure_firewall_management_center7.2.3.1any
ciscosecure_firewall_management_center7.2.4any
ciscosecure_firewall_management_center7.2.4.1any
ciscosecure_firewall_management_center7.2.5any
ciscosecure_firewall_management_center7.3.0any
ciscosecure_firewall_management_center7.3.1any
ciscosecure_firewall_management_center7.3.1.1any
ciscosecure_firewall_management_center7.3.1.2any
ciscofirepower_threat_defense6.4.0.4any
ciscofirepower_threat_defense6.4.0.10any
ciscofirepower_threat_defense6.4.0.12any
ciscofirepower_threat_defense6.4.0.14any
ciscofirepower_threat_defense6.4.0.16any
ciscofirepower_threat_defense6.4.0.18any
ciscofirepower_threat_defense6.6.5.1any
ciscofirepower_threat_defense6.6.7any
ciscofirepower_threat_defense6.7.0.2any
ciscofirepower_threat_defense7.1.0.1any
ciscofirepower_threat_defense7.1.0.3any
ciscofirepower_threat_defense7.2.2any
ciscofirepower_threat_defense7.4.1any

References 1

  • sec.cloudapps.cisco.com https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-infodisc-RL4mJFer
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.