CVE-2020-3580

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD): ASA and FTD Cross-Site Scripting (XSS)

As of , CVE-2020-3580 in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 3 November 2021
US federal deadline
3 May 2022181 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Known
EPSS score
0.86Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
Not availableCISA listed it before 4 February 2022, where the EPSS files we read begin.
Public exploit
None foundNeither Metasploit nor Exploit-DB lists one.
Fix
No vendor link in CISA's entry

What CISA says to do

Apply updates per vendor instructions.

CISA's required action

What the flaw is

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an insufficient input validation vulnerability for user-supplied input by the web services interface. Successful exploitation could allow an attacker to perform cross-site scripting (XSS) in the context of the interface or access sensitive browser-based information.

CISA's description

Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.

The CVE record's description, from cisco

CVE published
21 October 2020
Assigned by
cisco
CVSS
6.1 Medium (CVSS 3.1, from the CNA)
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CISA SSVC, exploitation
active
CISA SSVC, automatable
no
CISA SSVC, technical impact
partial

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.

Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD): other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2024-20353ASA and FTD Denial of ServiceCisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)Patch this weekEPSS 0.710.71
CVE-2020-3259ASA and FTD Information DisclosureCisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)Patch this weekRansomware use; EPSS 0.720.72
CVE-2020-3452ASA and FTD Read-Only Path TraversalCisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)Patch this weekEPSS 0.990.99
CVE-2024-20359ASA and FTD Privilege EscalationCisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)Patch soon0.19
CVE-2024-20481ASA and FTD Denial-of-ServiceCisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)Patch soon0.16

Read further