Cisco has fixed two high-severity vulnerabilities affecting its Cisco Secure Client enterprise VPN and endpoint security solution, one of which (CVE-2024-20337) could be exploited by unauthenticated, remote attackers to grab users’ valid SAML authentication token. “The attacker could then use the token to establish a remote access VPN session with the privileges of the affected user,” Cisco says, but notes that “individual hosts and services behind the VPN headend would still need additional credentials for successful access.” Cisco Secure Client vulnerabilities (CVE-2024-20337, CVE-2024-20338) CVE-2024-20337 is a carriage return line feed (CRLF) injection vulnerability.

Source: Help Net Security