Sign-up

ID

VAR-202005-0712


CVE

CVE-2020-3312


TITLE

Cisco Firepower Threat Defense Vulnerability in improper permission assignment for critical resources in software

Trust: 0.8

sources: JVNDB: JVNDB-2020-005212

DESCRIPTION

A vulnerability in the application policy configuration of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data on an affected device. The vulnerability is due to insufficient application identification. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain unauthorized read access to sensitive data

Trust: 1.8

sources: NVD: CVE-2020-3312 // JVNDB: JVNDB-2020-005212 // VULHUB: VHN-181437 // VULMON: CVE-2020-3312

AFFECTED PRODUCTS

vendor:ciscomodel:firepower management centerscope:eqversion:6.2.3

Trust: 1.1

vendor:ciscomodel:firepower management centerscope:eqversion:6.2.3.10

Trust: 1.1

vendor:ciscomodel:firepower management centerscope:eqversion:6.3.0

Trust: 1.1

vendor:ciscomodel:firepower management centerscope:eqversion:6.4.0

Trust: 1.1

vendor:ciscomodel:firepower management centerscope:eqversion:6.5.0

Trust: 1.1

vendor:ciscomodel:firepower threat defense softwarescope: - version: -

Trust: 0.8

sources: VULMON: CVE-2020-3312 // JVNDB: JVNDB-2020-005212 // NVD: CVE-2020-3312

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-3312
value: HIGH

Trust: 1.0

ykramarz@cisco.com: CVE-2020-3312
value: MEDIUM

Trust: 1.0

NVD: JVNDB-2020-005212
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202005-204
value: HIGH

Trust: 0.6

VULHUB: VHN-181437
value: MEDIUM

Trust: 0.1

VULMON: CVE-2020-3312
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-3312
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

NVD: JVNDB-2020-005212
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-181437
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-3312
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

ykramarz@cisco.com: CVE-2020-3312
baseSeverity: MEDIUM
baseScore: 5.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.0

Trust: 1.0

NVD: JVNDB-2020-005212
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-181437 // VULMON: CVE-2020-3312 // JVNDB: JVNDB-2020-005212 // CNNVD: CNNVD-202005-204 // NVD: CVE-2020-3312 // NVD: CVE-2020-3312

PROBLEMTYPE DATA

problemtype:CWE-732

Trust: 1.9

problemtype:CWE-284

Trust: 1.0

sources: VULHUB: VHN-181437 // JVNDB: JVNDB-2020-005212 // NVD: CVE-2020-3312

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202005-204

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-202005-204

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2020-005212

PATCH
title:cisco-sa-ftd-infodis-kZxGtUJDurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-infodis-kZxGtUJD
Trust: 0.8
title:Cisco Firepower Threat Defense Fixes for access control error vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=117806
Trust: 0.6
title:Cisco: Cisco Firepower Threat Defense Software Information Disclosure  Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-ftd-infodis-kZxGtUJD
Trust: 0.1
title:The Registerurl:https://www.theregister.co.uk/2020/05/07/cisco_may_patches/
Trust: 0.1
sources:
            
            
            VULMON: CVE-2020-3312 // 
            
            
            
            JVNDB: JVNDB-2020-005212 // 
            
            
            
            CNNVD: CNNVD-202005-204

EXTERNAL IDS
db:NVDid:CVE-2020-3312
Trust: 2.6
db:JVNDBid:JVNDB-2020-005212
Trust: 0.8
db:CNNVDid:CNNVD-202005-204
Trust: 0.7
db:AUSCERTid:ESB-2020.1614
Trust: 0.6
db:AUSCERTid:ESB-2020.1614.2
Trust: 0.6
db:CNVDid:CNVD-2020-27106
Trust: 0.1
db:VULHUBid:VHN-181437
Trust: 0.1
db:VULMONid:CVE-2020-3312
Trust: 0.1
sources:
            
            
            VULHUB: VHN-181437 // 
            
            
            
            VULMON: CVE-2020-3312 // 
            
            
            
            JVNDB: JVNDB-2020-005212 // 
            
            
            
            CNNVD: CNNVD-202005-204 // 
            
            
            
            NVD: CVE-2020-3312

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-ftd-infodis-kzxgtujd
Trust: 1.8
url:https://nvd.nist.gov/vuln/detail/cve-2020-3312
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-3312
Trust: 0.8
url:https://www.auscert.org.au/bulletins/esb-2020.1614/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2020.1614.2/
Trust: 0.6
url:https://cwe.mitre.org/data/definitions/732.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/181543
Trust: 0.1
sources:
            
            
            VULHUB: VHN-181437 // 
            
            
            
            VULMON: CVE-2020-3312 // 
            
            
            
            JVNDB: JVNDB-2020-005212 // 
            
            
            
            CNNVD: CNNVD-202005-204 // 
            
            
            
            NVD: CVE-2020-3312

SOURCES
db:VULHUBid:VHN-181437
db:VULMONid:CVE-2020-3312
db:JVNDBid:JVNDB-2020-005212
db:CNNVDid:CNNVD-202005-204
db:NVDid:CVE-2020-3312

LAST UPDATE DATE
2024-08-14T14:03:47.726000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-181437date:2020-05-12T00:00:00
db:VULMONid:CVE-2020-3312date:2020-05-12T00:00:00
db:JVNDBid:JVNDB-2020-005212date:2020-06-09T00:00:00
db:CNNVDid:CNNVD-202005-204date:2020-05-13T00:00:00
db:NVDid:CVE-2020-3312date:2020-05-12T15:41:58.597

SOURCES RELEASE DATE
db:VULHUBid:VHN-181437date:2020-05-06T00:00:00
db:VULMONid:CVE-2020-3312date:2020-05-06T00:00:00
db:JVNDBid:JVNDB-2020-005212date:2020-06-09T00:00:00
db:CNNVDid:CNNVD-202005-204date:2020-05-06T00:00:00
db:NVDid:CVE-2020-3312date:2020-05-06T17:15:13.667