Sign-up

ID

VAR-202010-1131


CVE

CVE-2020-3581


TITLE

Cisco Adaptive Security Appliance  and  Cisco Firepower Threat Defense  Cross-site scripting vulnerabilities in software

Trust: 0.8

sources: JVNDB: JVNDB-2020-012621

DESCRIPTION

Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section. The platform provides features such as highly secure access to data and network resources

Trust: 1.8

sources: NVD: CVE-2020-3581 // JVNDB: JVNDB-2020-012621 // VULHUB: VHN-181706 // VULMON: CVE-2020-3581

AFFECTED PRODUCTS

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:9.10.1.44

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:9.9.2.80

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:gteversion:9.13

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:9.8.4.29

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:ltversion:6.5.0.5

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:9.12.4.4

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:ltversion:6.4.0.10

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:gteversion:6.4.0

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:ltversion:6.3.0.6

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:gteversion:6.5.0

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:gteversion:6.6.0

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:gteversion:9.12

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:gteversion:9.9

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:9.14.1.30

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:gteversion:9.10

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:ltversion:6.6.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:gteversion:9.14

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:9.13.1.13

Trust: 1.0

vendor:シスコシステムズmodel:cisco adaptive security appliance ソフトウェアscope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco firepower threat defense ソフトウェアscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2020-012621 // NVD: CVE-2020-3581

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-3581
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2020-3581
value: MEDIUM

Trust: 1.0

NVD: CVE-2020-3581
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202010-1176
value: MEDIUM

Trust: 0.6

VULHUB: VHN-181706
value: LOW

Trust: 0.1

VULMON: CVE-2020-3581
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2020-3581
severity: LOW
baseScore: 2.6
vectorString: AV:N/AC:H/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 4.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-181706
severity: LOW
baseScore: 2.6
vectorString: AV:N/AC:H/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 4.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-3581
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 2.7
version: 3.1

Trust: 2.0

NVD: CVE-2020-3581
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-181706 // VULMON: CVE-2020-3581 // JVNDB: JVNDB-2020-012621 // CNNVD: CNNVD-202010-1176 // NVD: CVE-2020-3581 // NVD: CVE-2020-3581

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.1

problemtype:Cross-site scripting (CWE-79) [NVD Evaluation ]

Trust: 0.8

sources: VULHUB: VHN-181706 // JVNDB: JVNDB-2020-012621 // NVD: CVE-2020-3581

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202010-1176

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202010-1176

PATCH

title:cisco-sa-asaftd-xss-multiple-FCB3vPZeurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe

Trust: 0.8

sources: JVNDB: JVNDB-2020-012621

EXTERNAL IDS

db:NVDid:CVE-2020-3581

Trust: 2.6

db:JVNDBid:JVNDB-2020-012621

Trust: 0.8

db:CNNVDid:CNNVD-202010-1176

Trust: 0.7

db:AUSCERTid:ESB-2020.3642

Trust: 0.6

db:AUSCERTid:ESB-2020.3642.3

Trust: 0.6

db:NSFOCUSid:50197

Trust: 0.6

db:VULHUBid:VHN-181706

Trust: 0.1

db:VULMONid:CVE-2020-3581

Trust: 0.1

sources: VULHUB: VHN-181706 // VULMON: CVE-2020-3581 // JVNDB: JVNDB-2020-012621 // CNNVD: CNNVD-202010-1176 // NVD: CVE-2020-3581

REFERENCES

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-asaftd-xss-multiple-fcb3vpze

Trust: 2.4

url:https://nvd.nist.gov/vuln/detail/cve-2020-3581

Trust: 1.4

url:https://vigilance.fr/vulnerability/cisco-asa-software-cross-site-scripting-via-web-services-33675

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.3642.3

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.3642/

Trust: 0.6

url:http://www.nsfocus.net/vulndb/50197

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/79.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-181706 // VULMON: CVE-2020-3581 // JVNDB: JVNDB-2020-012621 // CNNVD: CNNVD-202010-1176 // NVD: CVE-2020-3581

SOURCES

db:VULHUBid:VHN-181706
db:VULMONid:CVE-2020-3581
db:JVNDBid:JVNDB-2020-012621
db:CNNVDid:CNNVD-202010-1176
db:NVDid:CVE-2020-3581

LAST UPDATE DATE

2024-11-23T21:35:10.227000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-181706date:2022-05-26T00:00:00
db:VULMONid:CVE-2020-3581date:2020-10-28T00:00:00
db:JVNDBid:JVNDB-2020-012621date:2021-05-17T09:06:00
db:CNNVDid:CNNVD-202010-1176date:2022-05-30T00:00:00
db:NVDid:CVE-2020-3581date:2024-11-21T05:31:21.237

SOURCES RELEASE DATE

db:VULHUBid:VHN-181706date:2020-10-21T00:00:00
db:VULMONid:CVE-2020-3581date:2020-10-21T00:00:00
db:JVNDBid:JVNDB-2020-012621date:2021-05-17T00:00:00
db:CNNVDid:CNNVD-202010-1176date:2020-10-21T00:00:00
db:NVDid:CVE-2020-3581date:2020-10-21T19:15:18.700