CVE-2024-20388

A vulnerability in the password change feature of Cisco Firepower Management Center (FMC) software could allow an unauthenticated, remote attacker to determine valid user names on an affected device. This vulnerability is due to improper authentication of password update responses. An attacker could exploit this vulnerability by forcing a password reset on an affected device. A successful exploit could allow the attacker to determine valid user names in the unauthenticated response to a forced password reset.

Scoring

Severity

MEDIUM

CVSS base score

5.3

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS probability

0.41%

CWE

CWE-202

Published

2024-10-23

Last modified

2026-03-13

Affected products

• Cisco Cisco Firepower Management Center
• Cisco Cisco Firepower Management Center
• Cisco Cisco Firepower Management Center
• Cisco Cisco Firepower Management Center
• Cisco Cisco Firepower Management Center
• Cisco Cisco Firepower Management Center
• Cisco Cisco Firepower Management Center
• Cisco Cisco Firepower Management Center

Weakness type

• CWE-202

Related vulnerabilities

• CVE-2026-16520 — Improper input validation and Exposure of sensitive information through data queries vulnerability...
• CVE-2026-25703 — Potential information leakage from manager /network/graph API in NeuVector
• CVE-2026-70473 — Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
• CVE-2026-42797 — Apache Syncope: JexlContextBuilder Information Disclosure
• CVE-2026-40245 — Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication
• CVE-2026-30778 — Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.
• CVE-2026-33530 — InvenTree Vulnerable to ORM Filter Injection
• CVE-2026-3546 — e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action

Markdown version · Browse all CVEs