Details of VAR-202003-1177

ID

VAR-202003-1177

CVE

CVE-2020-3164

TITLE

plural Cisco Product input verification vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2020-002425

DESCRIPTION

A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated remote attacker to cause high CPU usage on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of specific HTTP request headers. An attacker could exploit this vulnerability by sending a malformed HTTP request to an affected device. A successful exploit could allow the attacker to trigger a prolonged status of high CPU utilization relative to the GUI process(es). Upon successful exploitation of this vulnerability, an affected device will still be operative, but its response time and overall performance may be degraded. are all products of Cisco in the United States. The device is mainly used to manage all strategies, reports, audit information, etc. of e-mail and Web security devices. AsyncOS Software is a set of operating systems running in it. The device provides SaaS-based access control, real-time network reporting and tracking, and formulating security policies. AsyncOS web management interface in many Cisco products has an input verification error vulnerability, which stems from the failure to properly verify the HTTP request header. The following products and versions are affected: Cisco ESA 13.0.0-392 and earlier (Release); Cisco Cloud Email Security 13.0.0-392 and earlier (Release); Cisco WSA 12.0.1-268 and earlier (Release) ; Cisco SMA 13.6.0 and earlier versions (Release)

Trust: 2.25

sources: NVD: CVE-2020-3164 // JVNDB: JVNDB-2020-002425 // CNVD: CNVD-2020-32909 // VULHUB: VHN-181289

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-32909

AFFECTED PRODUCTS

vendor:	cisco	model:	email security appliance	scope:	lte	version:	13.0.0-392	Trust: 1.0
vendor:	cisco	model:	web security appliance	scope:	lte	version:	12.0.1-268	Trust: 1.0
vendor:	cisco	model:	cloud email security	scope:	lte	version:	13.0.0-392	Trust: 1.0
vendor:	cisco	model:	content security management appliance	scope:	lt	version:	13.6.0	Trust: 1.0
vendor:	cisco	model:	cloud email security	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	e email security appliance	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	web security appliance	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	content security management appliance	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	email security appliance	scope:	lte	version:	<=13.0.0-392	Trust: 0.6
vendor:	cisco	model:	cloud email security	scope:	lte	version:	<=13.0.0-392	Trust: 0.6
vendor:	cisco	model:	web security appliance	scope:	lte	version:	<=12.0.1-268	Trust: 0.6
vendor:	cisco	model:	content security management appliance	scope:	lte	version:	<=13.6.0	Trust: 0.6

sources: CNVD: CNVD-2020-32909 // JVNDB: JVNDB-2020-002425 // NVD: CVE-2020-3164

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-3164
value:	MEDIUM
Trust: 1.0
ykramarz@cisco.com:	CVE-2020-3164
value:	MEDIUM
Trust: 1.0
NVD:	JVNDB-2020-002425
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2020-32909
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202003-184
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-181289
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2020-3164
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2020-002425
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2020-32909
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-181289
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2020-3164
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	LOW
exploitabilityScore:	3.9
impactScore:	1.4
version:	3.1
Trust: 1.0
ykramarz@cisco.com:	CVE-2020-3164
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	LOW
exploitabilityScore:	3.9
impactScore:	1.4
version:	3.0
Trust: 1.0
NVD:	JVNDB-2020-002425
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	LOW
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-32909 // VULHUB: VHN-181289 // JVNDB: JVNDB-2020-002425 // CNNVD: CNNVD-202003-184 // NVD: CVE-2020-3164 // NVD: CVE-2020-3164

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-181289 // JVNDB: JVNDB-2020-002425 // NVD: CVE-2020-3164

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202003-184

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202003-184

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-002425

PATCH

title:	cisco-sa-cont-sec-gui-dos-nJ625dXb	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cont-sec-gui-dos-nJ625dXb	Trust: 0.8
title:	Patch for Multiple Cisco products AsyncOS input verification error vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/221575	Trust: 0.6
title:	Multiple Cisco product AsyncOS Enter the fix for the verification error vulnerability	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=111118	Trust: 0.6

sources: CNVD: CNVD-2020-32909 // JVNDB: JVNDB-2020-002425 // CNNVD: CNNVD-202003-184

EXTERNAL IDS

db:	NVD	id:	CVE-2020-3164	Trust: 3.1
db:	JVNDB	id:	JVNDB-2020-002425	Trust: 0.8
db:	CNNVD	id:	CNNVD-202003-184	Trust: 0.7
db:	CNVD	id:	CNVD-2020-32909	Trust: 0.6
db:	AUSCERT	id:	ESB-2020.0800	Trust: 0.6
db:	NSFOCUS	id:	47392	Trust: 0.6
db:	VULHUB	id:	VHN-181289	Trust: 0.1

sources: CNVD: CNVD-2020-32909 // VULHUB: VHN-181289 // JVNDB: JVNDB-2020-002425 // CNNVD: CNNVD-202003-184 // NVD: CVE-2020-3164

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2020-3164	Trust: 2.0
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-cont-sec-gui-dos-nj625dxb	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-3164	Trust: 0.8
url:	https://vigilance.fr/vulnerability/cisco-asyncos-overload-via-http-request-headers-31727	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2020.0800/	Trust: 0.6
url:	http://www.nsfocus.net/vulndb/47392	Trust: 0.6

sources: CNVD: CNVD-2020-32909 // VULHUB: VHN-181289 // JVNDB: JVNDB-2020-002425 // CNNVD: CNNVD-202003-184 // NVD: CVE-2020-3164

SOURCES

db:	CNVD	id:	CNVD-2020-32909
db:	VULHUB	id:	VHN-181289
db:	JVNDB	id:	JVNDB-2020-002425
db:	CNNVD	id:	CNNVD-202003-184
db:	NVD	id:	CVE-2020-3164

LAST UPDATE DATE

2024-11-23T22:11:35.832000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-32909	date:	2020-06-15T00:00:00
db:	VULHUB	id:	VHN-181289	date:	2020-03-05T00:00:00
db:	JVNDB	id:	JVNDB-2020-002425	date:	2020-03-16T00:00:00
db:	CNNVD	id:	CNNVD-202003-184	date:	2020-08-04T00:00:00
db:	NVD	id:	CVE-2020-3164	date:	2024-11-21T05:30:27.597

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-32909	date:	2020-06-15T00:00:00
db:	VULHUB	id:	VHN-181289	date:	2020-03-04T00:00:00
db:	JVNDB	id:	JVNDB-2020-002425	date:	2020-03-16T00:00:00
db:	CNNVD	id:	CNNVD-202003-184	date:	2020-03-04T00:00:00
db:	NVD	id:	CVE-2020-3164	date:	2020-03-04T19:15:12.930