CVE-2020-3452

🗓️ 22 Jul 2020 20:00:22Reported by ciscoType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 1487 Views🌐 WEB

A vulnerability in Cisco ASA and FTD Software allows remote attackers to conduct directory traversal attacks and read sensitive file

Reporter	Title	Published	Views	Family All 70
0day.today	Cisco Adaptive Security Appliance Software 9.11 - Local File Inclusion Exploit	29 Jul 202000:00	–	zdt
0day.today	Cisco Adaptive Security Appliance Software 9.7 - Unauthenticated Arbitrary File Deletion Exploit	30 Jul 202000:00	–	zdt
GithubExploit	Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software	3 Aug 202011:02	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software	25 Jul 202016:11	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software	24 Jul 202015:04	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software	13 Dec 202013:47	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software	3 Feb 202105:45	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software	1 Aug 202008:27	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software	18 Nov 202021:31	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software	16 May 202622:49	–	githubexploit

NVD

Vulners

Node

cisco adaptive_security_appliance_softwareRange9.6–9.6.4.42

cisco adaptive_security_appliance_softwareRange9.8–9.8.4.20

cisco adaptive_security_appliance_softwareRange9.9–9.9.2.74

cisco adaptive_security_appliance_softwareRange9.10–9.10.1.42

cisco adaptive_security_appliance_softwareRange9.12–9.12.3.12

cisco adaptive_security_appliance_softwareRange9.13–9.13.1.10

cisco adaptive_security_appliance_softwareRange9.14–9.14.1.10

AND

cisco asa_5505Match-

cisco asa_5510Match-

cisco asa_5512-xMatch-

cisco asa_5515-xMatch-

cisco asa_5520Match-

cisco asa_5525-xMatch-

cisco asa_5540Match-

cisco asa_5545-xMatch-

cisco asa_5550Match-

cisco asa_5555-xMatch-

cisco asa_5580Match-

cisco asa_5585-xMatch-

Node

cisco firepower_threat_defenseRange6.2.3–6.2.3.16

cisco firepower_threat_defenseRange6.3.0–6.3.0.6

cisco firepower_threat_defenseRange6.4.0–6.4.0.10

cisco firepower_threat_defenseRange6.5.0–6.5.0.5

cisco firepower_threat_defenseRange6.6.0–6.6.0.1

[
  {
    "product": "Cisco Adaptive Security Appliance (ASA) Software",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "9.6.4.42",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "9.8.4.20",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "9.9.2.74",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "9.10.1.42",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "9.13.1.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "9.14.1.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/158646/Cisco-ASA-FTD-Remote-File-Disclosure.html
packetstormsecurity	www.packetstormsecurity.com/files/158647/Cisco-Adaptive-Security-Appliance-Software-9.11-Local-File-Inclusion.html
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ro-path-KJuQhB86
packetstormsecurity	www.packetstormsecurity.com/files/160497/Cisco-ASA-9.14.1.10-FTD-6.6.0.1-Path-Traversal.html
packetstormsecurity	www.packetstormsecurity.com/files/159523/Cisco-ASA-FTD-9.6.4.42-Path-Traversal.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
type	query param	/+CSCOT+/translation-table	Path traversal vulnerability via translation-table endpoint exposed in Cisco ASA/FTD web services (CVE-2020-3452)	CWE-20, CWE-22
textdomain	query param	/+CSCOT+/translation-table	Path traversal vulnerability via translation-table endpoint exposed in Cisco ASA/FTD web services (CVE-2020-3452)	CWE-20, CWE-22
default-language	query param	/+CSCOT+/translation-table	Path traversal vulnerability via translation-table endpoint exposed in Cisco ASA/FTD web services (CVE-2020-3452)	CWE-20, CWE-22
lang	query param	/+CSCOT+/translation-table	Path traversal vulnerability via translation-table endpoint exposed in Cisco ASA/FTD web services (CVE-2020-3452)	CWE-20, CWE-22