CVE-2020-3582

cisco secure firewall threat defense, cisco firepower threat defense, cisco adaptive security appliance software

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2020-3582

Katalog CVE

CVSS 6.1 · Medium EPSS 1,2%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada cisco secure firewall threat defense, cisco firepower threat defense +1 lainnya. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.

Rincian

Terbit di NVD
21 Oktober 2020
Terakhir diubah
11 Agustus 2026
Status NVD
Modified
CVSS 3.1
6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari)
1,2% peluang dieksploitasi; lebih tinggi dari 66,2% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
cisco secure firewall threat defense Versi 6.4.0 hingga sebelum 6.4.0.10
cisco firepower threat defense Semua versi sebelum 6.3.0.6
cisco firepower threat defense Versi 6.5.0 hingga sebelum 6.5.0.5
cisco firepower threat defense Versi 6.6.0 hingga sebelum 6.6.1
cisco adaptive security appliance software Semua versi sebelum 9.8.4.26
cisco adaptive security appliance software Versi 9.9 hingga sebelum 9.9.2.80
cisco adaptive security appliance software Versi 9.10 hingga sebelum 9.10.1.44
cisco adaptive security appliance software Versi 9.12 hingga sebelum 9.12.4.4
cisco adaptive security appliance software Versi 9.13 hingga sebelum 9.13.1.13
cisco adaptive security appliance software Versi 9.14 hingga sebelum 9.14.1.30

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.