CVE-2020-3187

🗓️ 06 May 2020 16:41:01Reported by ciscoType

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 452 Views🌐 WEB

A vulnerability in Cisco ASA & FTD Software enables directory traversal attacks, allowing remote attackers to access sensitive files via crafted HTTP requests

Reporter	Title	Published	Views	Family All 42
zdt	Cisco Adaptive Security Appliance Software 9.7 - Unauthenticated Arbitrary File Deletion Exploit	30 Jul 202000:00	–	zdt
Tenable Nessus	Rockwell Automation Stratix 5950 Industrial EtherNet/IP Security Appliance <= 16.4 Directory Traversal Attack	22 May 202000:00	–	nessus
Tenable Nessus	Cisco Adaptive Security Appliance Software Web Services Path Traversal (cisco-sa-asaftd-path-JE3azWw43)	27 May 202000:00	–	nessus
Tenable Nessus	Cisco Firepower Threat Defense Software Web Services Path Traversal (cisco-sa-asaftd-path-JE3azWw43)	27 May 202000:00	–	nessus
Tenable Nessus	Cisco ASA Path Traversal (CVE-2020-3187)	5 Oct 202600:00	–	nessus
attackerkb	CVE-2020-3187	6 May 202000:00	–	attackerkb
attackerkb	CVE-2020-3452 Cisco ASA / Firepower Read-Only Path Traversal Vulnerability	22 Jul 202000:00	–	attackerkb
attackerkb	CVE-2020-3580	21 Oct 202000:00	–	attackerkb
BDU FSTEC	The vulnerability of the web interface of Cisco Adaptive Security Appliance (ASA) and Configure Firepower Threat Defense (FTD) allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	15 May 202000:00	–	bdu_fstec
Circl	CVE-2020-3187	25 Jul 202011:11	–	circl

NVD

Node

cisco secure_firewall_threat_defenseRange6.2.3–6.2.3.16

cisco secure_firewall_threat_defenseRange6.3.0–6.3.0.6

cisco secure_firewall_threat_defenseRange6.4.0–6.4.0.8

cisco secure_firewall_threat_defenseRange6.5.0–6.5.0.4

Node

AND

cisco asa_5505_firmwareMatch9.6(4)

cisco asa_5505Match-

Node

AND

cisco asa_5510_firmwareMatch9.6(4)

cisco asa_5510Match-

Node

AND

cisco asa_5512-x_firmwareMatch9.6(4)

cisco asa_5512-xMatch-

Node

AND

cisco asa_5515-x_firmwareMatch9.6(4)

cisco asa_5515-xMatch-

Node

AND

cisco asa_5520_firmwareMatch9.6(4)

cisco asa_5520Match-

Node

AND

cisco asa_5525-x_firmwareMatch9.6(4)

cisco asa_5525-xMatch-

Node

AND

cisco asa_5540_firmwareMatch9.6(4)

cisco asa_5540Match-

Node

AND

cisco asa_5545-x_firmwareMatch9.6(4)

cisco asa_5545-xMatch-

Node

AND

cisco asa_5550_firmwareMatch9.6(4)

cisco asa_5550Match-

Node

AND

cisco asa_5555-x_firmwareMatch9.6(4)

cisco asa_5555-xMatch-

Node

AND

cisco asa_5580_firmwareMatch9.6(4)

cisco asa_5580Match-

Node

AND

cisco asa_5585-x_firmwareMatch9.6(4)

cisco asa_5585-xMatch-

Node

cisco adaptive_security_appliance_softwareRange9.6–9.6.4.40

cisco adaptive_security_appliance_softwareRange9.8–9.8.4.15

cisco adaptive_security_appliance_softwareRange9.9–9.9.2.66

cisco adaptive_security_appliance_softwareRange9.10–9.10.1.37

cisco adaptive_security_appliance_softwareRange9.12–9.12.3.2

cisco adaptive_security_appliance_softwareRange9.13–9.13.1.7

[
  {
    "product": "Cisco Adaptive Security Appliance (ASA) Software",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/158648/Cisco-Adaptive-Security-Appliance-Software-9.7-Arbitrary-File-Deletion.html
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-path-JE3azWw43

Parameter	Position	Path	Description	CWE
delete	path	/+CSCOU+/$delete	Unauthenticated directory traversal in Cisco ASA/FTD web services allowing read/delete of arbitrary files via crafted URL path.	CWE-22
name	query param	/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=%2bCSCOE%2b/portal_inc.lua	Directory traversal via the name query parameter in the oem-customization endpoint to read arbitrary files (e.g., portal_inc.lua) within the web services file system.	CWE-22

11 Aug 2026 19:33Current

8.9High risk

Vulners AI Score8.9

CVSS 27.5

CVSS 3.19.1

CVSS 39.1

EPSS0.96595

SSVC