CVE-2020-3259

high · 7.5Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Added 2024-02-15Remediation due 2024-03-07

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit this vulnerability by sending a crafted GET request to the web services interface. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.

7.5

CVSS

71.8%

EPSS (exploit prob.)

99th

EPSS percentile

2020-05-06

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-200

Affected products

Vendor	Product	Affected versions
cisco	secure_firewall_threat_defense	>= 6.2.3, < 6.2.3.16
cisco	secure_firewall_threat_defense	>= 6.3.0, < 6.3.0.6
cisco	secure_firewall_threat_defense	>= 6.4.0, < 6.4.0.9
cisco	secure_firewall_threat_defense	>= 6.5.0, < 6.5.0.5
cisco	adaptive_security_appliance_software	>= 9.8, < 9.8.4.20
cisco	adaptive_security_appliance_software	>= 9.9, < 9.9.2.67
cisco	adaptive_security_appliance_software	>= 9.10, < 9.10.1.40
cisco	adaptive_security_appliance_software	>= 9.12, < 9.12.3.9
cisco	adaptive_security_appliance_software	>= 9.13, < 9.13.1.10

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-3259