Cisco ASA Exposure of Sensitive Information to an Unauthorized Actor (CVE-2020-3259)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(506194);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/06");

  script_cve_id("CVE-2020-3259");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2024/03/07");
  script_xref(name:"CEA-ID", value:"CEA-2020-0042");

  script_name(english:"Cisco ASA Exposure of Sensitive Information to an Unauthorized Actor (CVE-2020-3259)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the web services interface of Cisco Adaptive
Security Appliance (ASA) Software and Cisco Firepower Threat Defense
(FTD) Software could allow an unauthenticated, remote attacker to
retrieve memory contents on an affected device, which could lead to
the disclosure of confidential information. The vulnerability is due
to a buffer tracking issue when the software parses invalid URLs that
are requested from the web services interface. An attacker could
exploit this vulnerability by sending a crafted GET request to the web
services interface. A successful exploit could allow the attacker to
retrieve memory contents, which could lead to the disclosure of
confidential information. Note: This vulnerability affects only
specific AnyConnect and WebVPN configurations. For more information,
see the Vulnerable Products section.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3259
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8650ff40");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ca70b7e2");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-3259");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(200);

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/05/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/05/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:adaptive_security_appliance_software:9.8" :
        {"versionEndExcluding" : "9.8.4.20", "versionStartIncluding" : "9.8", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.9" :
        {"versionEndExcluding" : "9.9.2.67", "versionStartIncluding" : "9.9", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.10" :
        {"versionEndExcluding" : "9.10.1.40", "versionStartIncluding" : "9.10", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.12" :
        {"versionEndExcluding" : "9.12.3.9", "versionStartIncluding" : "9.12", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.13" :
        {"versionEndExcluding" : "9.13.1.10", "versionStartIncluding" : "9.13", "family" : "CiscoFirepower"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);