漏洞

[1329818050]

漏洞ID：

CVE-2023-20028

CVE-2023-20119

CVE-2023-20120

想请教知道漏洞id，查询涉及的产品以及漏洞解决方法。

[Rockyw]

可以利用思科openVuln API，自动化的查询特定思科产品的安全漏洞，并且通过Excel的方式展现这些漏洞信息，也可以通过思科提供的图形化界面来查询漏洞信息，可以登录网站https://sec.cloudapps.cisco.com/security/center/publicationListing.x查询思科设备的漏洞信息。也可以查询特定版本的漏洞信息，链接：https://sec.cloudapps.cisco.com/security/center/softwarechecker.x

[Rockyw]

还有https://bst.cloudapps.cisco.com/bugsearch

[Rps-Cheers]

请参考如下Security advisories

...

Affected Products

• Vulnerable Products

  At the time of publication, CVE-2023-20028 affected the following Cisco products:

  • Secure Email and Web Manager, both virtual and hardware appliances
  • Secure Web Appliance, both virtual and hardware appliances

  At the time of publication, CVE-2023-20119 affected Cisco Secure Email and Web Manager, both virtual and hardware appliances.

  At the time of publication, CVE-2023-20120 affected the following Cisco products:

  • Secure Email and Web Manager, both virtual and hardware appliances
  • Secure Email Gateway, both virtual and hardware appliances
  • Secure Web Appliance, both virtual and hardware appliances

  For information about which Cisco software releases were vulnerable at the time of publication, see the Fixed Software section of this advisory. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.

  Products Confirmed Not Vulnerable

  Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.

  Cisco has confirmed that CVE-2023-20028 does not affect Cisco Secure Email Gateway, both virtual and hardware appliances.

  Cisco has confirmed that CVE-2023-20119 does not affect the following Cisco products:

  • Secure Email Gateway, both virtual and hardware appliances
  • Secure Web Appliance, both virtual and hardware appliances

  ...

  Workarounds

  • There are no workarounds that address these vulnerabilities.

    Fixed Releases

    At the time of publication, the release information in the following tables was accurate. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.

    The left column lists Cisco software releases, and the right column indicates whether a release was affected by the vulnerabilities that are described in this advisory and which release included the fix for these vulnerabilities.

    Secure Email and Web Manager

    Cisco AsyncOS Release	First Fixed Release for CVE-2023-20028, CVE-2023-20119, and CVE-2023-20120
    14.3 and earlier	Migrate to a fixed release.
    15.0	15.0.01 (Jul 2023)

    Secure Email Gateway

    Cisco AsyncOS Release	First Fixed Release for CVE-2023-20120
    14.3 and earlier2	Migrate to a fixed release.
    15.0	15.0.01 (Jul 2023)

    Secure Web Appliance

    Cisco AsyncOS Release	First Fixed Release for CVE-2023-20028 and CVE-2023-20120
    14.5 and earlier	Migrate to a fixed release.
    15.0	15.0.0-3321

    1. This release is a Limited Deployment (LD) release. Customers who wish to upgrade to this release can contact Cisco TAC to provision this release to their appliances. The General Deployment (GD) release is currently under review and will be available in the future.

    2. For customers using Cisco Secure Email Cloud Gateway, no action is required. Cisco has taken actions to protect the infrastructure from this vulnerability, and upgrades to fixed releases will be deployed as part of the standard upgrade processes for the environment.

    In most cases, the software can be upgraded over the network by using the System Upgrade options in the web interface of the appliance. To upgrade a device by using the web interface, do the following:

    1. Choose System Administration > System Upgrade.
    2. Click Upgrade Options.
    3. Choose Download and Install.
    4. Choose the release to upgrade to.
    5. In the Upgrade Preparation area, choose the appropriate options.
    6. Click Proceed to begin the upgrade. A progress bar displays the status of the upgrade.

    After the upgrade is complete, the device reboots.

    The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.

    ...

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-xss-cP9DuEmq