Lucene search

[email protected]CVE-2020-3550

HistoryOct 21, 2020 - 7:15 p.m.

CVE-2020-3550

2020-10-2119:15:17

CWE-22

[email protected]

web.nvd.nist.gov

cisco

fmc

ftd

vulnerability

directory traversal

cve-2020-3550

nvd

5.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

7.9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.9%

JSON

A vulnerability in the sfmgr daemon of Cisco Firepower Management Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to perform directory traversal and access directories outside the restricted path. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by using a relative path in specific sfmgr commands. An exploit could allow the attacker to read or write arbitrary files on an sftunnel-connected peer device.

Affected configurations

NVD

Node

ciscofirepower_management_centerRange≤6.0.1

ciscofirepower_management_centerRange6.3.0–6.3.0.6

ciscofirepower_management_centerRange6.4.0–6.4.0.10

ciscofirepower_management_centerMatch6.2.0

ciscofirepower_management_centerMatch6.2.1

ciscofirepower_threat_defenseRange≤6.0.1

ciscofirepower_threat_defenseRange6.3.0–6.3.0.6

ciscofirepower_threat_defenseRange6.4.0–6.4.0.10

ciscofirepower_threat_defenseMatch6.2.0

ciscofirepower_threat_defenseMatch6.2.1

CPENameOperatorVersion
cisco:firepower_management_centercisco firepower management centerle6.0.1
cisco:firepower_management_centercisco firepower management centerlt6.3.0.6
cisco:firepower_management_centercisco firepower management centerlt6.4.0.10
cisco:firepower_management_centercisco firepower management centereq6.2.0
cisco:firepower_management_centercisco firepower management centereq6.2.1
cisco:firepower_threat_defensecisco firepower threat defensele6.0.1
cisco:firepower_threat_defensecisco firepower threat defenselt6.3.0.6
cisco:firepower_threat_defensecisco firepower threat defenselt6.4.0.10
cisco:firepower_threat_defensecisco firepower threat defenseeq6.2.0
cisco:firepower_threat_defensecisco firepower threat defenseeq6.2.1

CPE	Name	Operator	Version
cisco:firepower_management_center	cisco firepower management center	le	6.0.1
cisco:firepower_management_center	cisco firepower management center	lt	6.3.0.6
cisco:firepower_management_center	cisco firepower management center	lt	6.4.0.10
cisco:firepower_management_center	cisco firepower management center	eq	6.2.0
cisco:firepower_management_center	cisco firepower management center	eq	6.2.1
cisco:firepower_threat_defense	cisco firepower threat defense	le	6.0.1
cisco:firepower_threat_defense	cisco firepower threat defense	lt	6.3.0.6
cisco:firepower_threat_defense	cisco firepower threat defense	lt	6.4.0.10
cisco:firepower_threat_defense	cisco firepower threat defense	eq	6.2.0
cisco:firepower_threat_defense	cisco firepower threat defense	eq	6.2.1

CNA Affected

[
  {
    "product": "Cisco Firepower Management Center ",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftdfmc-dirtrav-NW8XcuSB

5.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

7.9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.9%

JSON

Related for CVE-2020-3550

cisco1 prion1 cvelist1 nvd1