CVE-2020-3452

cisco adaptive security appliance software, cisco secure firewall threat defense

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2020-3452

Katalog CVE

CVSS 7.5 · High KEV · sudah dieksploitasi EPSS 100,0%

Kerentanan Improper Input Validation pada cisco adaptive security appliance software, cisco secure firewall threat defense. Skor CVSS 3.1 7.5 (High) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device. The web services file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability cannot be used to obtain access to ASA or FTD system files or underlying operating system (OS) files.

Rincian

Terbit di NVD
22 Juli 2020
Terakhir diubah
11 Agustus 2026
Status NVD
Analyzed
CVSS 3.1
7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-20: Improper Input Validation
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari)
100,0% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama
Cisco ASA and FTD Read-Only Path Traversal Vulnerability
Masuk KEV
3 November 2021
Tenggat CISA
3 Mei 2022 (untuk instansi federal AS)
Ransomware
Belum tercatat
Tindakan wajib
Apply updates per vendor instructions.

Produk dan versi terdampak

VendorProdukVersi terdampak
cisco adaptive security appliance software Versi 9.6 hingga sebelum 9.6.4.42
cisco adaptive security appliance software Versi 9.8 hingga sebelum 9.8.4.20
cisco adaptive security appliance software Versi 9.9 hingga sebelum 9.9.2.74
cisco adaptive security appliance software Versi 9.10 hingga sebelum 9.10.1.42
cisco adaptive security appliance software Versi 9.12 hingga sebelum 9.12.3.12
cisco adaptive security appliance software Versi 9.13 hingga sebelum 9.13.1.10
cisco adaptive security appliance software Versi 9.14 hingga sebelum 9.14.1.10
cisco secure firewall threat defense Versi 6.2.3 hingga sebelum 6.2.3.16
cisco secure firewall threat defense Versi 6.3.0 hingga sebelum 6.3.0.6
cisco secure firewall threat defense Versi 6.4.0 hingga sebelum 6.4.0.10
cisco secure firewall threat defense Versi 6.5.0 hingga sebelum 6.5.0.5
cisco secure firewall threat defense Versi 6.6.0 hingga sebelum 6.6.0.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.