{"metadata": {"vulnerability": "CVE-2024-20337", "count": 39, "kinds": {"milestone": 8, "sighting": 10, "kev": 0, "other": 21}}, "data": [{"timestamp": "2023-11-08T15:08:07.642Z", "date_only": false, "value": "2023-11-08T15:08:07.642Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2024-20337", "field": "cveMetadata.dateReserved"}, {"timestamp": "2023-12-13T01:21:43.043Z", "date_only": false, "value": "2023-12-13T01:21:43.043763Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2024-20337", "record": "GSD-2024-20337", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-03-06T15:53:43Z", "date_only": false, "value": "2024-03-06T15:53:43+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-SECURE-CLIENT-CRLF-W43V4G7", "record": "CISCO-SA-SECURE-CLIENT-CRLF-W43V4G7", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2024-03-06T16:00:00Z", "date_only": false, "value": "2024-03-06T16:00:00+00:00", "kind": "milestone", "label": "Published", "source": "csaf_cisco \u00b7 CISCO-SA-SECURE-CLIENT-CRLF-W43V4G7", "record": "CISCO-SA-SECURE-CLIENT-CRLF-W43V4G7", "field": "document.tracking.initial_release_date"}, {"timestamp": "2024-03-06T16:30:02.285Z", "date_only": false, "value": "2024-03-06T16:30:02.285Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2024-20337", "field": "cveMetadata.datePublished"}, {"timestamp": "2024-03-06T16:30:02.285Z", "date_only": false, "value": "2024-03-06T16:30:02.285Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / cisco", "record": "CVE-2024-20337", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2024-03-06T17:15:09Z", "date_only": false, "value": "2024-03-06T17:15:09Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-J296-JHQ5-3X6C", "record": "GHSA-J296-JHQ5-3X6C", "field": "database_specific.nvd_published_at"}, {"timestamp": "2024-03-06T17:15:09.580Z", "date_only": false, "value": "2024-03-06T17:15:09.580", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-20337", "record": "FKIE_CVE-2024-20337", "field": "published"}, {"timestamp": "2024-03-06T17:15:09.580Z", "date_only": false, "value": "2024-03-06T17:15:09.580", "kind": "milestone", "label": "Published", "source": "gsd \u00b7 GSD-2024-20337", "record": "GSD-2024-20337", "field": "namespaces.nvd.nist.gov.cve.published"}, {"timestamp": "2024-03-06T18:26:41Z", "date_only": false, "value": "2024-03-06T18:26:41.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/201616", "record": "CVE-2024-20337", "field": "creation_timestamp", "uuid": "3e0cdcfa-3f51-4ab4-9587-673e8cc82bd1", "content": "https://ift.tt/A5VckWr\nCVE-2024-20337", "url": "https://t.me/ctinow/201616"}, {"timestamp": "2024-03-06T18:30:37Z", "date_only": false, "value": "2024-03-06T18:30:37Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-J296-JHQ5-3X6C", "record": "GHSA-J296-JHQ5-3X6C", "field": "published"}, {"timestamp": "2024-03-06T18:30:37Z", "date_only": false, "value": "2024-03-06T18:30:37Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-J296-JHQ5-3X6C", "record": "GHSA-J296-JHQ5-3X6C", "field": "modified"}, {"timestamp": "2024-03-06T23:00:00Z", "date_only": false, "value": "2024-03-06T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-0565", "record": "WID-SEC-W-2024-0565", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2024-03-06T23:00:00Z", "date_only": false, "value": "2024-03-06T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-0565", "record": "WID-SEC-W-2024-0565", "field": "document.tracking.initial_release_date"}, {"timestamp": "2024-03-06T23:00:00Z", "date_only": false, "value": "2024-03-06T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-0565", "record": "WID-SEC-W-2024-0565", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2024-03-06T23:00:00Z", "date_only": false, "value": "2024-03-06T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-0565", "record": "WID-SEC-W-2024-0565", "field": "document.tracking.current_release_date"}, {"timestamp": "2024-03-07T00:00:00Z", "date_only": false, "value": "2024-03-07T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0190", "record": "CERTFR-2024-AVI-0190", "field": "last_revision_date"}, {"timestamp": "2024-03-07T00:00:00Z", "date_only": false, "value": "2024-03-07T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0190", "record": "CERTFR-2024-AVI-0190", "field": "initial_release_date"}, {"timestamp": "2024-03-07T00:00:00Z", "date_only": false, "value": "2024-03-07T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0190", "record": "CERTFR-2024-AVI-0190", "field": "revisions.0.revision_date"}, {"timestamp": "2024-03-07T13:52:27.110Z", "date_only": false, "value": "2024-03-07T13:52:27.110", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2024-20337", "record": "GSD-2024-20337", "field": "namespaces.nvd.nist.gov.cve.lastModified"}, {"timestamp": "2024-03-08T02:42:36Z", "date_only": false, "value": "2024-03-08T02:42:36.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/4151", "record": "CVE-2024-20337", "field": "creation_timestamp", "uuid": "a2a07608-a6a8-42d9-a991-fc633b51603e", "content": "#ExploitObserverAlert\n\nCVE-2024-20337\n\nDESCRIPTION: Exploit Observer has 3 entries in 1 file formats related to CVE-2024-20337. A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF) injection attack against a user.   This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link while establishing a VPN session. A successful exploit could allow the attacker to execute arbitrary script code in the browser or access sensitive, browser-based information, including a valid SAML token. The attacker could then use the token to establish a remote access VPN session with the privileges of the affected user. Individual hosts and services behind the VPN headend would still need additional credentials for successful access.\n\nFIRST-EPSS: 0.000430000", "url": "https://t.me/arpsyndicate/4151"}, {"timestamp": "2024-03-08T09:54:04Z", "date_only": false, "value": "2024-03-08T09:54:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/om41bhtexu6EH2VRF4O26t18r89Dj-HJSWZ2_e-In0v8Eg", "record": "CVE-2024-20337", "field": "creation_timestamp", "uuid": "9a5d99a5-1f16-42f6-af0f-8dd99dfca6a4"}, {"timestamp": "2024-03-08T10:07:09Z", "date_only": false, "value": "2024-03-08T10:07:09.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/KomunitiSiber/1606", "record": "CVE-2024-20337", "field": "creation_timestamp", "uuid": "7f82b8be-7adc-477c-b8ad-5df1a4b9a9e7", "content": "Cisco Issues Patch for High-Severity VPN Hijacking Bug in Secure Client\nhttps://thehackernews.com/2024/03/cisco-issues-patch-for-high-severity.html\n\nCisco has released patches to address a high-severity security flaw impacting its Secure Client software that could be exploited by a threat actor to open a VPN session with that of a targeted user.\nThe networking equipment company described the vulnerability, tracked as CVE-2024-20337 (CVSS score: 8.2), as allowing an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF", "url": "https://t.me/KomunitiSiber/1606"}, {"timestamp": "2024-03-08T10:07:10Z", "date_only": false, "value": "2024-03-08T10:07:10.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/4657", "record": "CVE-2024-20337", "field": "creation_timestamp", "uuid": "716830e4-a1bf-4889-af33-8b2b2566d899", "content": "\ud83d\udea8 Cisco issued patches for a high-severity flaw (CVE-2024-20337) in Secure Client software on Windows, Linux, and macOS. Attackers could hijack VPN sessions. \n \nCheck and update now: https://thehackernews.com/2024/03/cisco-issues-patch-for-high-severity.html", "url": "https://t.me/thehackernews/4657"}, {"timestamp": "2024-03-08T12:21:34Z", "date_only": false, "value": "2024-03-08T12:21:34.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/203247", "record": "CVE-2024-20337", "field": "creation_timestamp", "uuid": "aeeb373b-92c6-4ccb-a947-b2a259f6ba81", "content": "https://ift.tt/EhRZCnd\nCisco patches Secure Client VPN flaw that could reveal authentication tokens (CVE-2024-20337)", "url": "https://t.me/ctinow/203247"}, {"timestamp": "2024-03-08T13:17:00Z", "date_only": false, "value": "2024-03-08T13:17:00.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/huaxANwb_3-GYLMpbOhauKE2iba1wUBKyxZrBJOnlk3UGg", "record": "CVE-2024-20337", "field": "creation_timestamp", "uuid": "add79f87-1eac-43b7-b728-90ba7a11de34"}, {"timestamp": "2024-03-09T05:00:57.702Z", "date_only": false, "value": "2024-03-09T05:00:57.702576Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2024-20337", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2024-03-09T05:00:57.702Z", "date_only": false, "value": "2024-03-09T05:00:57.702576Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-20337", "record": "FKIE_CVE-2024-20337", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2024-03-09T10:21:33Z", "date_only": false, "value": "2024-03-09T10:21:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ap_security/495", "record": "CVE-2024-20337", "field": "creation_timestamp", "uuid": "5809c553-c10c-42a3-9096-1661807ed29a", "content": "#itnews #infosec\n\nCisco \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0432\u044b\u0441\u043e\u043a\u043e \u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 VPN \u0432 Secure Client\ud83c\udff4\u200d\u2620\ufe0f\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cisco \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438 Secure Client, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0434\u043b\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f VPN-\u0441\u0435\u0441\u0441\u0438\u0438 \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f-\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043e\u043f\u0438\u0441\u0430\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434 \u043a\u043e\u0434\u043e\u0432\u044b\u043c \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c CVE-2024-20337 (CVSS score: 8.2), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443, \u043d\u0435 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u043c\u0443 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438, \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443 CRLF\n\n\u0412\u043e\u0437\u043d\u0438\u043a\u0430\u044f \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0434\u0430\u043d\u043d\u044b\u0445, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u043e\u0442 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u043c\u0430\u043d\u043e\u043c \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u043f\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0441\u044b\u043b\u043a\u0435 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f VPN-\u0441\u0435\u0441\u0441\u0438\u0438", "url": "https://t.me/ap_security/495"}, {"timestamp": "2024-03-10T06:17:24Z", "date_only": false, "value": "2024-03-10T06:17:24.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/6771", "record": "CVE-2024-20337", "field": "creation_timestamp", "uuid": "09d998cf-2d0c-4047-a092-5b0905617b03", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aCVE-2024-20337 POC Cisco Secure Client CRLF RCE and unauthorized remote access to VPN sessions\nURL\uff1ahttps://github.com/swagcraftedd/CVE-2024-20337-POC\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/6771"}, {"timestamp": "2024-03-10T14:16:42Z", "date_only": false, "value": "2024-03-10T14:16:42.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/204263", "record": "CVE-2024-20337", "field": "creation_timestamp", "uuid": "65fc7a04-0a48-4d0f-b8b6-376fc7136b36", "content": "https://ift.tt/KnhEojY\nCVE-2024-20337 Exploit", "url": "https://t.me/ctinow/204263"}, {"timestamp": "2024-03-12T14:17:07Z", "date_only": false, "value": "2024-03-12T14:17:07+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-SECURE-CLIENT-CRLF-W43V4G7", "record": "CISCO-SA-SECURE-CLIENT-CRLF-W43V4G7", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2024-03-12T14:17:07Z", "date_only": false, "value": "2024-03-12T14:17:07+00:00", "kind": "other", "label": "Updated", "source": "csaf_cisco \u00b7 CISCO-SA-SECURE-CLIENT-CRLF-W43V4G7", "record": "CISCO-SA-SECURE-CLIENT-CRLF-W43V4G7", "field": "document.tracking.current_release_date"}, {"timestamp": "2024-05-10T23:29:20Z", "date_only": false, "value": "2024-05-10T23:29:20+00:00", "kind": "other", "label": "Document generated", "source": "csaf_cisco \u00b7 CISCO-SA-SECURE-CLIENT-CRLF-W43V4G7", "record": "CISCO-SA-SECURE-CLIENT-CRLF-W43V4G7", "field": "document.tracking.generator.date"}, {"timestamp": "2024-07-25T17:00:36.986Z", "date_only": false, "value": "2024-07-25T17:00:36.986Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2024-20337", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-08-01T21:59:42.871Z", "date_only": false, "value": "2024-08-01T21:59:42.871Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2024-20337", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-08-01T21:59:42.871Z", "date_only": false, "value": "2024-08-01T21:59:42.871Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2024-20337", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2024-08-15T18:06:10.960Z", "date_only": false, "value": "2024-08-15T18:06:10.960+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-0565", "record": "WID-SEC-W-2024-0565", "field": "document.tracking.generator.date"}, {"timestamp": "2026-06-17T07:06:44.920Z", "date_only": false, "value": "2026-06-17T07:06:44.920", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-20337", "record": "FKIE_CVE-2024-20337", "field": "lastModified"}]}