CVE-2020-3187

🗓️ 06 May 2020 16:41:01Reported by ciscoType

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 387 Views🌐 WEB

A vulnerability in Cisco ASA & FTD Software enables directory traversal attacks, allowing remote attackers to access sensitive files via crafted HTTP requests

Reporter	Title	Published	Views	Family All 35
0day.today	Cisco Adaptive Security Appliance Software 9.7 - Unauthenticated Arbitrary File Deletion Exploit	30 Jul 202000:00	–	zdt
Tenable Nessus	Rockwell Automation Stratix 5950 Industrial EtherNet/IP Security Appliance <= 16.4 Directory Traversal Attack	22 May 202000:00	–	nessus
Tenable Nessus	Cisco Adaptive Security Appliance Software Web Services Path Traversal (cisco-sa-asaftd-path-JE3azWw43)	27 May 202000:00	–	nessus
Tenable Nessus	Cisco Firepower Threat Defense Software Web Services Path Traversal (cisco-sa-asaftd-path-JE3azWw43)	27 May 202000:00	–	nessus
ATTACKERKB	CVE-2020-3187	6 May 202000:00	–	attackerkb
ATTACKERKB	CVE-2020-3452 Cisco ASA / Firepower Read-Only Path Traversal Vulnerability	22 Jul 202000:00	–	attackerkb
ATTACKERKB	CVE-2020-3580	21 Oct 202000:00	–	attackerkb
BDU FSTEC	The vulnerability of the web interface of Cisco Adaptive Security Appliance (ASA) and Configure Firepower Threat Defense (FTD) allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	15 May 202000:00	–	bdu_fstec
Circl	CVE-2020-3187	25 Jul 202011:11	–	circl
Cisco	Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Path Traversal Vulnerability	6 May 202016:00	–	cisco

NVD

Node

cisco firepower_threat_defenseRange6.2.3–6.2.3.16

cisco firepower_threat_defenseRange6.3.0–6.3.0.6

cisco firepower_threat_defenseRange6.4.0–6.4.0.8

cisco firepower_threat_defenseRange6.5.0–6.5.0.4

Node

AND

cisco asa_5505_firmwareMatch9.6(4)

cisco asa_5505Match-

Node

AND

cisco asa_5510_firmwareMatch9.6(4)

cisco asa_5510Match-

Node

AND

cisco asa_5512-x_firmwareMatch9.6(4)

cisco asa_5512-xMatch-

Node

AND

cisco asa_5515-x_firmwareMatch9.6(4)

cisco asa_5515-xMatch-

Node

AND

cisco asa_5520_firmwareMatch9.6(4)

cisco asa_5520Match-

Node

AND

cisco asa_5525-x_firmwareMatch9.6(4)

cisco asa_5525-xMatch-

Node

AND

cisco asa_5540_firmwareMatch9.6(4)

cisco asa_5540Match-

Node

AND

cisco asa_5545-x_firmwareMatch9.6(4)

cisco asa_5545-xMatch-

Node

AND

cisco asa_5550_firmwareMatch9.6(4)

cisco asa_5550Match-

Node

AND

cisco asa_5555-x_firmwareMatch9.6(4)

cisco asa_5555-xMatch-

Node

AND

cisco asa_5580_firmwareMatch9.6(4)

cisco asa_5580Match-

Node

AND

cisco asa_5585-x_firmwareMatch9.6(4)

cisco asa_5585-xMatch-

Node

cisco adaptive_security_appliance_softwareRange9.6–9.6.4.40

cisco adaptive_security_appliance_softwareRange9.8–9.8.4.15

cisco adaptive_security_appliance_softwareRange9.9–9.9.2.66

cisco adaptive_security_appliance_softwareRange9.10–9.10.1.37

cisco adaptive_security_appliance_softwareRange9.12–9.12.3.2

cisco adaptive_security_appliance_softwareRange9.13–9.13.1.7

[
  {
    "product": "Cisco Adaptive Security Appliance (ASA) Software",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

Source	Link
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-path-JE3azWw43
packetstormsecurity	www.packetstormsecurity.com/files/158648/Cisco-Adaptive-Security-Appliance-Software-9.7-Arbitrary-File-Deletion.html

Parameter	Position	Path	Description	CWE
delete	path	/+CSCOU+/$delete	Unauthenticated arbitrary file deletion via directory traversal in CSCOU path.	CWE-22
delete	path	/+CSCOU+/csco_logo.gif	Targeted file deletion via directory traversal in CSCOU path (csco_logo.gif).	CWE-22
app	path	/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=<read>	OEM customization endpoint exploited for traversal to access arbitrary resources.	CWE-22
type	path	/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=<read>	OEM customization endpoint exploited for traversal to access arbitrary resources.	CWE-22
platform	path	/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=<read>	OEM customization endpoint exploited for traversal to access arbitrary resources.	CWE-22
resource-type	path	/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=<read>	OEM customization endpoint exploited for traversal to access arbitrary resources.	CWE-22
name	path	/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=<read>	OEM customization endpoint exploited for traversal to access arbitrary resources.	CWE-22
portal_inc.lua	path	/+CSCOE+/portal_inc.lua	Portal script path exposed to traversal via crafted requests (AnyConnect/CSCOT context).	CWE-22

17 Jun 2026 03:17Current

8.9High risk

Vulners AI Score8.9

CVSS 27.5

CVSS 3.19.1

CVSS 39.1

EPSS0.96595

SSVC