nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2020-3580 CVE-2020-3580
MEDIUMCISA KEVRansomwareNuclei
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities
Record summary
CVE-2020-3580 has a selected CVSS score of 6.1 (medium); EIP currently links 4 repository PoCs and 1 Nuclei template. CISA lists CVE-2020-3580 in KEV and reports its use in known ransomware campaigns.
Description
Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.
Description source: CVE List
Exploitation context
Known exploitation
- CISA KEV
- Listed · Nov 3, 2021 · CISA
- VulnCheck KEV
- Listed · Nov 3, 2021 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
- Ransomware use
- Observed · CISA
Available material
CISA SSVC decision
ExploitationActive
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 8, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)Browse Cisco / Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | CISA | Version data not supplied | |
Cisco Adaptive Security Appliance (ASA) SoftwareBrowse Cisco / Cisco Adaptive Security Appliance (ASA) Software | CVE List | Version range not supplied | affected |
Proofs of concept
4Repository PoCs
GitHubHudi233/CVE-2020-3580Repository PoCby Hudi233Stars: 9Not analyzed1 file
GitHubadarshvs/CVE-2020-3580Repository PoCby adarshvsStars: 19Not analyzed3 files
GitHubcruxN3T/CVE-2020-3580Repository PoCby cruxN3TStars: 0Not analyzed21 files
GitHubcatatonicprime/CVE-2020-3580Repository PoCby catatonicprimeStars: 2Not analyzed3 files
Nuclei templates
1ProjectDiscoveryMEDIUMCisco ASA/FTD Software - Cross-Site ScriptingCVSS 6.1
Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software are vulnerable to cross-site scripting and could allow an unauthenticated, remote attacker to conduct attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the reference links.
Impact
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of a targeted user's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
Remediation
Apply the latest security patches or updates provided by Cisco to mitigate this vulnerability.
WeaknessesCWE-79
Authorspikpikcu
Template tagscvecve2020xssciscokevvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:o:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*
https://twitter.com/ptswarm/status/1408050644460650502 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe https://nvd.nist.gov/vuln/detail/CVE-2020-3580 https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors https://github.com/r0eXpeR/supplier
Source: ProjectDiscovery
References
320201021 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting VulnerabilitiesVendor advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe cisa.govGovernment resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3580