vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF) injection attack against a user. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link while establishing a VPN session. A successful exploit could allow the attacker to execute arbitrary script code in the browser or access sensitive, browser-based information, including a valid SAML token. The attacker could then use the token to establish a remote access VPN session with the privileges of the affected user. Individual hosts and services behind the VPN headend would still need additional credentials for successful access.
Configuration 1 (hide)
| AND |
|
22 Jul 2025, 18:00
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-client-crlf-W43V4G7 - Vendor Advisory | |
| First Time |
Cisco secure Client
Apple macos Microsoft windows Linux linux Kernel Microsoft Linux Apple Cisco |
|
| CPE | cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:secure_client:*:*:*:*:*:*:*:* |
21 Nov 2024, 08:52
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-client-crlf-W43V4G7 - |
Published : 2024-03-06 17:15
Updated : 2025-07-22 18:00
NVD link : CVE-2024-20337
Mitre link : CVE-2024-20337
CVE.ORG link : CVE-2024-20337
JSON object : View
Improper Neutralization of CRLF Sequences ('CRLF Injection')