Sign-up

ID

VAR-202009-1116


CVE

CVE-2020-3117


TITLE

Cisco Web Security Appliance  and  Cisco Content Security Management Appliance  for  Cisco AsyncOS  Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2020-011711

DESCRIPTION

A vulnerability in the API Framework of Cisco AsyncOS for Cisco Web Security Appliance (WSA) and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to inject crafted HTTP headers in the web server's response. The vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user to access a crafted URL and receive a malicious HTTP response. A successful exploit could allow the attacker to inject arbitrary HTTP headers into valid HTTP responses sent to a user's browser. The device provides SaaS-based access control, real-time network reporting and tracking, and formulating security policies. The device is mainly used to manage all strategies, reports, audit information, etc. of e-mail and Web security devices. AsyncOS Software is a set of operating systems running in it

Trust: 2.34

sources: NVD: CVE-2020-3117 // JVNDB: JVNDB-2020-011711 // CNVD: CNVD-2020-19232 // VULHUB: VHN-181242 // VULMON: CVE-2020-3117

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2020-19232

AFFECTED PRODUCTS

vendor:ciscomodel:content security management appliancescope:ltversion:13.0.0-187

Trust: 1.0

vendor:ciscomodel:web security appliancescope:eqversion:12.0.1-268

Trust: 1.0

vendor:ciscomodel:web security appliancescope:eqversion:11.8.0-382

Trust: 1.0

vendor:シスコシステムズmodel:cisco コンテンツ セキュリティ管理アプライアンスscope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco web セキュリティ アプライアンスscope: - version: -

Trust: 0.8

vendor:ciscomodel:content security management appliancescope: - version: -

Trust: 0.6

vendor:ciscomodel:web security appliancescope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2020-19232 // JVNDB: JVNDB-2020-011711 // NVD: CVE-2020-3117

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-3117
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2020-3117
value: MEDIUM

Trust: 1.0

NVD: CVE-2020-3117
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2020-19232
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202002-296
value: MEDIUM

Trust: 0.6

VULHUB: VHN-181242
value: MEDIUM

Trust: 0.1

VULMON: CVE-2020-3117
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-3117
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2020-19232
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-181242
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

ykramarz@cisco.com: CVE-2020-3117
baseSeverity: MEDIUM
baseScore: 4.7
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 1.4
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2020-3117
baseSeverity: MEDIUM
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 1.4
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2020-19232 // VULHUB: VHN-181242 // VULMON: CVE-2020-3117 // JVNDB: JVNDB-2020-011711 // CNNVD: CNNVD-202002-296 // NVD: CVE-2020-3117 // NVD: CVE-2020-3117

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:CWE-113

Trust: 1.0

problemtype:Other (CWE-Other) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2020-011711 // NVD: CVE-2020-3117

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202002-296

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202002-296

PATCH

title:cisco-sa-20200122-wsa-sma-header-injecturl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-wsa-sma-header-inject

Trust: 0.8

title:Patch for Cisco Web Security Appliance and Cisco Content Security Management Appliance HTTP Header Injection Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/210769

Trust: 0.6

title:Cisco Web Security Appliance and Content Security Management Appliance AsyncOS Repair measures for injecting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=110472

Trust: 0.6

title:Cisco: Cisco Web Security Appliance and Cisco Content Security Management Appliance HTTP Header Injection Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20200122-wsa-sma-header-inject

Trust: 0.1

sources: CNVD: CNVD-2020-19232 // VULMON: CVE-2020-3117 // JVNDB: JVNDB-2020-011711 // CNNVD: CNNVD-202002-296

EXTERNAL IDS

db:NVDid:CVE-2020-3117

Trust: 3.2

db:JVNDBid:JVNDB-2020-011711

Trust: 0.8

db:CNNVDid:CNNVD-202002-296

Trust: 0.7

db:CNVDid:CNVD-2020-19232

Trust: 0.6

db:AUSCERTid:ESB-2020.0279.2

Trust: 0.6

db:VULHUBid:VHN-181242

Trust: 0.1

db:VULMONid:CVE-2020-3117

Trust: 0.1

sources: CNVD: CNVD-2020-19232 // VULHUB: VHN-181242 // VULMON: CVE-2020-3117 // JVNDB: JVNDB-2020-011711 // CNNVD: CNNVD-202002-296 // NVD: CVE-2020-3117

REFERENCES

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20200122-wsa-sma-header-inject

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2020-3117

Trust: 1.4

url:https://vigilance.fr/vulnerability/cisco-wsa-sma-read-write-access-via-http-header-injection-31408

Trust: 1.2

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/ cisco-sa-20200122-wsa-sma-header-inject

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.0279.2/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2020-19232 // VULHUB: VHN-181242 // VULMON: CVE-2020-3117 // JVNDB: JVNDB-2020-011711 // CNNVD: CNNVD-202002-296 // NVD: CVE-2020-3117

SOURCES

db:CNVDid:CNVD-2020-19232
db:VULHUBid:VHN-181242
db:VULMONid:CVE-2020-3117
db:JVNDBid:JVNDB-2020-011711
db:CNNVDid:CNNVD-202002-296
db:NVDid:CVE-2020-3117

LAST UPDATE DATE

2024-11-23T22:47:51.666000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2020-19232date:2020-03-25T00:00:00
db:VULHUBid:VHN-181242date:2020-10-01T00:00:00
db:VULMONid:CVE-2020-3117date:2020-10-01T00:00:00
db:JVNDBid:JVNDB-2020-011711date:2021-04-12T06:09:00
db:CNNVDid:CNNVD-202002-296date:2020-10-09T00:00:00
db:NVDid:CVE-2020-3117date:2024-11-21T05:30:21.650

SOURCES RELEASE DATE

db:CNVDid:CNVD-2020-19232date:2020-03-25T00:00:00
db:VULHUBid:VHN-181242date:2020-09-23T00:00:00
db:VULMONid:CVE-2020-3117date:2020-09-23T00:00:00
db:JVNDBid:JVNDB-2020-011711date:2021-04-12T00:00:00
db:CNNVDid:CNNVD-202002-296date:2020-02-03T00:00:00
db:NVDid:CVE-2020-3117date:2020-09-23T01:15:14.833