CVE-2020-3580: medium-severity vulnerability in Cisco Adaptive Security Appliance (ASA) Software
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities
Published · Updated
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 6.1epss 86%
from disclosure to weapon247 days
Published on NVDOct 21
1st PoC+247d
CISA KEV+378d
exploitation probability
86%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
8 public exploit(s)
Action required by CISAfederal deadline: 2022-05-03
Apply updates per vendor instructions.
In short
A weakness in Cisco ASA and Firepower Threat Defense web interfaces allows attackers to inject malicious scripts that run when users visit a crafted link. This could let attackers steal sensitive information or take control of the interface in the user's browser.
Technical detail
Reflected XSS vulnerabilities in the web services interface due to insufficient input validation. An unauthenticated remote attacker can craft a malicious link and socially engineer users to click it, resulting in arbitrary JavaScript execution within the user's authenticated session context, potentially leading to session hijacking or credential theft.
Summary generated and translated by AI from the official description.
Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.