CVE-2020-3452

🗓️ 22 Jul 2020 20:00:22Reported by ciscoType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 1596 Views🌐 WEB

A vulnerability in Cisco ASA and FTD Software allows remote attackers to conduct directory traversal attacks and read sensitive file

Reporter	Title	Published	Views	Family All 98
zdt	Cisco Adaptive Security Appliance Software 9.11 - Local File Inclusion Exploit	29 Jul 202000:00	–	zdt
zdt	Cisco Adaptive Security Appliance Software 9.7 - Unauthenticated Arbitrary File Deletion Exploit	30 Jul 202000:00	–	zdt
GithubExploit	Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software	3 Aug 202011:02	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software	25 Jul 202016:11	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software	24 Jul 202015:04	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software	13 Dec 202013:47	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software	3 Feb 202105:45	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software	1 Aug 202008:27	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software	18 Nov 202021:31	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software	16 May 202622:49	–	githubexploit

NVD

Vulners

Node

AND

cisco adaptive_security_appliance_softwareRange9.6–9.6.4.42

cisco adaptive_security_appliance_softwareRange9.8–9.8.4.20

cisco adaptive_security_appliance_softwareRange9.9–9.9.2.74

cisco adaptive_security_appliance_softwareRange9.10–9.10.1.42

cisco adaptive_security_appliance_softwareRange9.12–9.12.3.12

cisco adaptive_security_appliance_softwareRange9.13–9.13.1.10

cisco adaptive_security_appliance_softwareRange9.14–9.14.1.10

cisco asa_5505Match-

cisco asa_5510Match-

cisco asa_5512-xMatch-

cisco asa_5515-xMatch-

cisco asa_5520Match-

cisco asa_5525-xMatch-

cisco asa_5540Match-

cisco asa_5545-xMatch-

cisco asa_5550Match-

cisco asa_5555-xMatch-

cisco asa_5580Match-

cisco asa_5585-xMatch-

Node

cisco secure_firewall_threat_defenseRange6.2.3–6.2.3.16

cisco secure_firewall_threat_defenseRange6.3.0–6.3.0.6

cisco secure_firewall_threat_defenseRange6.4.0–6.4.0.10

cisco secure_firewall_threat_defenseRange6.5.0–6.5.0.5

cisco secure_firewall_threat_defenseRange6.6.0–6.6.0.1

[
  {
    "product": "Cisco Adaptive Security Appliance (ASA) Software",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "9.6.4.42",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "9.8.4.20",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "9.9.2.74",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "9.10.1.42",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "9.13.1.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "9.14.1.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/158646/Cisco-ASA-FTD-Remote-File-Disclosure.html
packetstormsecurity	www.packetstormsecurity.com/files/158647/Cisco-Adaptive-Security-Appliance-Software-9.11-Local-File-Inclusion.html
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ro-path-KJuQhB86
packetstormsecurity	www.packetstormsecurity.com/files/160497/Cisco-ASA-9.14.1.10-FTD-6.6.0.1-Path-Traversal.html
packetstormsecurity	www.packetstormsecurity.com/files/159523/Cisco-ASA-FTD-9.6.4.42-Path-Traversal.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
textdomain	query param	/+CSCOT+/translation-table	Path traversal via the translation-table endpoint enabling an unauthenticated remote attacker to read arbitrary files from the web services filesystem by injecting directory traversal sequences through textdomain and lang parameters.	CWE-22, CWE-20
lang	query param	/+CSCOT+/translation-table	Path traversal via the translation-table endpoint enabling an unauthenticated remote attacker to read arbitrary files from the web services filesystem by injecting directory traversal sequences through textdomain and lang parameters.	CWE-22, CWE-20