Lucene search

K
cve[email protected]CVE-2020-3456
HistoryOct 21, 2020 - 7:15 p.m.

CVE-2020-3456

2020-10-2119:15:16
CWE-352
web.nvd.nist.gov
43
cve-2020-3456
cisco
firepower
chassis manager
csrf
attack
security
vulnerability
fxos software
nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

35.4%

A vulnerability in the Cisco Firepower Chassis Manager (FCM) of Cisco FXOS Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of an affected device. The vulnerability is due to insufficient CSRF protections for the FCM interface. An attacker could exploit this vulnerability by persuading a targeted user to click a malicious link. A successful exploit could allow the attacker to send arbitrary requests that could take unauthorized actions on behalf of the targeted user.

Affected configurations

NVD
Node
ciscofirepower_extensible_operating_systemMatch2.4\(1.249\)
AND
ciscofirepower_4110Match-
OR
ciscofirepower_4112Match-
OR
ciscofirepower_4115Match-
OR
ciscofirepower_4120Match-
OR
ciscofirepower_4125Match-
OR
ciscofirepower_4140Match-
OR
ciscofirepower_4145Match-
OR
ciscofirepower_4150Match-
OR
ciscofirepower_9300_sm-24Match-
OR
ciscofirepower_9300_sm-36Match-
OR
ciscofirepower_9300_sm-40Match-
OR
ciscofirepower_9300_sm-44Match-
OR
ciscofirepower_9300_sm-44_x_3Match-
OR
ciscofirepower_9300_sm-48Match-
OR
ciscofirepower_9300_sm-56Match-
OR
ciscofirepower_9300_sm-56_x_3Match-

CNA Affected

[
  {
    "product": "Cisco Adaptive Security Appliance (ASA) Software ",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

35.4%