CVE-2020-3581

Published Oct 21, 2020

Last updated a year ago

CVSS medium 6.1

Overview

Description: Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.
Source: ykramarz@cisco.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.1
Impact score: 2.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

CVSS 2.0

Type: Primary
Base score: 2.6
Impact score: 2.9
Exploitability score: 4.9
Vector string: AV:N/AC:H/Au:N/C:N/I:P/A:N

Weaknesses

nvd@nist.gov: CWE-79
ykramarz@cisco.com: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E9F6C9AD-0838-4CE7-BF34-3BDAA4909704",
            "versionEndExcluding": "6.3.0.6"
          },
          {
            "criteria": "cpe:2.3:o:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "739E387B-4E43-4BD7-8799-F62791963508",
            "versionEndExcluding": "6.4.0.10",
            "versionStartIncluding": "6.4.0"
          },
          {
            "criteria": "cpe:2.3:o:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "38DCBF6C-AA34-4A5B-B2B1-57684DD5BB42",
            "versionEndExcluding": "6.5.0.5",
            "versionStartIncluding": "6.5.0"
          },
          {
            "criteria": "cpe:2.3:o:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3F0C6D76-9652-4EE6-9CA2-96BFBB469539",
            "versionEndExcluding": "6.6.1",
            "versionStartIncluding": "6.6.0"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B0C941D8-9723-4DC9-96BE-FED50E2275EB",
            "versionEndExcluding": "9.8.4.29"
          },
          {
            "criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "86B181C5-34C2-4BD5-B012-841B978A26C4",
            "versionEndExcluding": "9.9.2.80",
            "versionStartIncluding": "9.9"
          },
          {
            "criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D0854546-E8AC-41FC-9419-E3E31534D4FE",
            "versionEndExcluding": "9.10.1.44",
            "versionStartIncluding": "9.10"
          },
          {
            "criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A9B6C101-3EEF-430F-9191-7DDB3DDF40E8",
            "versionEndExcluding": "9.12.4.4",
            "versionStartIncluding": "9.12"
          },
          {
            "criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F21E8FD7-6BBB-4D7B-B21A-D5D57630800A",
            "versionEndExcluding": "9.13.1.13",
            "versionStartIncluding": "9.13"
          },
          {
            "criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A5E49F5A-F8E9-4D0D-A58F-9F5BB5F0C9EE",
            "versionEndExcluding": "9.14.1.30",
            "versionStartIncluding": "9.14"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Social media

Configurations

References