mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-07-09 16:05:11 +00:00
214 lines
8.5 KiB
JSON
214 lines
8.5 KiB
JSON
{
|
|
"id": "CVE-2020-3580",
|
|
"sourceIdentifier": "psirt@cisco.com",
|
|
"published": "2020-10-21T19:15:18.607",
|
|
"lastModified": "2025-02-24T15:36:35.007",
|
|
"vulnStatus": "Analyzed",
|
|
"cveTags": [],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "M\u00faltiples vulnerabilidades en la interfaz de servicios web de Cisco Adaptive Security Appliance (ASA) Software y Cisco Firepower Threat Defense (FTD) Software, podr\u00edan permitir a un atacante remoto no autenticado conducir ataques de tipo cross-site scripting (XSS) contra un usuario de la interfaz de servicios web de un dispositivo afectado. Las vulnerabilidades son debido a una comprobaci\u00f3n insuficiente de la entrada suministrada por el usuario mediante la interfaz de servicios web de un dispositivo afectado. Un atacante podr\u00eda explotar estas vulnerabilidades al persuadir a un usuario de la interfaz para que haga clic en un enlace dise\u00f1ado. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir a un atacante ejecutar un c\u00f3digo script arbitrario en el contexto de la interfaz o permitir a un atacante acceder a informaci\u00f3n confidencial basada en el navegador. Nota: Estas vulnerabilidades afectan solo a configuraciones espec\u00edficas de AnyConnect y WebVPN. Para m\u00e1s informaci\u00f3n, consulte la secci\u00f3n Vulnerable Products"
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV31": [
|
|
{
|
|
"source": "psirt@cisco.com",
|
|
"type": "Secondary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"baseScore": 6.1,
|
|
"baseSeverity": "MEDIUM",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "REQUIRED",
|
|
"scope": "CHANGED",
|
|
"confidentialityImpact": "LOW",
|
|
"integrityImpact": "LOW",
|
|
"availabilityImpact": "NONE"
|
|
},
|
|
"exploitabilityScore": 2.8,
|
|
"impactScore": 2.7
|
|
},
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"baseScore": 6.1,
|
|
"baseSeverity": "MEDIUM",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "REQUIRED",
|
|
"scope": "CHANGED",
|
|
"confidentialityImpact": "LOW",
|
|
"integrityImpact": "LOW",
|
|
"availabilityImpact": "NONE"
|
|
},
|
|
"exploitabilityScore": 2.8,
|
|
"impactScore": 2.7
|
|
}
|
|
],
|
|
"cvssMetricV2": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "2.0",
|
|
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
|
|
"baseScore": 2.6,
|
|
"accessVector": "NETWORK",
|
|
"accessComplexity": "HIGH",
|
|
"authentication": "NONE",
|
|
"confidentialityImpact": "NONE",
|
|
"integrityImpact": "PARTIAL",
|
|
"availabilityImpact": "NONE"
|
|
},
|
|
"baseSeverity": "LOW",
|
|
"exploitabilityScore": 4.9,
|
|
"impactScore": 2.9,
|
|
"acInsufInfo": false,
|
|
"obtainAllPrivilege": false,
|
|
"obtainUserPrivilege": false,
|
|
"obtainOtherPrivilege": false,
|
|
"userInteractionRequired": true
|
|
}
|
|
]
|
|
},
|
|
"cisaExploitAdd": "2021-11-03",
|
|
"cisaActionDue": "2022-05-03",
|
|
"cisaRequiredAction": "Apply updates per vendor instructions.",
|
|
"cisaVulnerabilityName": "Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability",
|
|
"weaknesses": [
|
|
{
|
|
"source": "psirt@cisco.com",
|
|
"type": "Secondary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-79"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-79"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"configurations": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*",
|
|
"versionEndExcluding": "6.4.0.12",
|
|
"matchCriteriaId": "2449A498-7072-4C05-8BA9-614A950B3C3E"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.5.0",
|
|
"versionEndExcluding": "6.6.4",
|
|
"matchCriteriaId": "3DA331CB-9D54-47F9-B48A-36268278C2EE"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.7.0",
|
|
"versionEndExcluding": "6.7.0.2",
|
|
"matchCriteriaId": "05A1A309-650A-4E6C-AFCE-CD0FB62492D6"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
|
|
"versionEndExcluding": "9.8.4.34",
|
|
"matchCriteriaId": "A0362F9B-B1B5-405A-A984-09B29B173888"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "9.9",
|
|
"versionEndExcluding": "9.9.2.85",
|
|
"matchCriteriaId": "8A9BFFBC-F577-47CD-83E8-A6227B17D557"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "9.10",
|
|
"versionEndExcluding": "9.12.4.13",
|
|
"matchCriteriaId": "1C70E158-4028-4CA4-91CB-22E549CFBC07"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "9.13",
|
|
"versionEndExcluding": "9.13.1.21",
|
|
"matchCriteriaId": "5B74C14F-C95B-4AF5-A255-1CA824AA7FDE"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "9.14",
|
|
"versionEndExcluding": "9.14.2.8",
|
|
"matchCriteriaId": "282F4D3B-CCBB-484E-BDEE-C316637E2F21"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "9.15",
|
|
"versionEndExcluding": "9.15.1.15",
|
|
"matchCriteriaId": "9D2794F2-BC8F-42CC-910A-203BE7B3475F"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe",
|
|
"source": "psirt@cisco.com",
|
|
"tags": [
|
|
"Patch",
|
|
"Vendor Advisory"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe",
|
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
|
"tags": [
|
|
"Patch",
|
|
"Vendor Advisory"
|
|
]
|
|
}
|
|
]
|
|
} |