cisco adaptive-security-appliance CVE-2020-3259 vulnerability in Cisco Products
Published on May 6, 2020

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit this vulnerability by sending a crafted GET request to the web services interface. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.

Vendor Advisory NVD

Known Exploited Vulnerability

This Cisco ASA and FTD Information Disclosure Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.

The following remediation steps are recommended / required by March 7, 2024: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vulnerability Analysis

CVE-2020-3259 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.


Products Associated with CVE-2020-3259

You can be notified by stack.watch whenever vulnerabilities like CVE-2020-3259 are published in these products:

Cisco Adaptive Security Appliance
 
Cisco Firepower Threat Defense
 
Cisco Adaptive Security Appliance Software
 

What versions are vulnerable to CVE-2020-3259?