CVEs / CVE-2020-3259
CVE-2020-3259: Cisco ASA and FTD Information Disclosure Vulnerability
- Known exploited in the CISA KEV catalog since 15 Feb 2024
- high 7.5 CVSS 3.1 (NVD)
- EPSS 71.5% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2020-3259
Summary
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.
Description
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit this vulnerability by sending a crafted GET request to the web services interface. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Adaptive Security Appliance (ASA) Software | n/a | — |
| cisco firepower_threat_defense | from 6.2.3, before 6.2.3.16 | 6.2.3.16 |
| cisco firepower_threat_defense | from 6.3.0, before 6.3.0.6 | 6.3.0.6 |
| cisco firepower_threat_defense | from 6.4.0, before 6.4.0.9 | 6.4.0.9 |
| cisco firepower_threat_defense | from 6.5.0, before 6.5.0.5 | 6.5.0.5 |
| cisco adaptive_security_appliance_software | from 9.8, before 9.8.4.20 | 9.8.4.20 |
| cisco adaptive_security_appliance_software | from 9.9, before 9.9.2..67 | 9.9.2..67 |
| cisco adaptive_security_appliance_software | from 9.10, before 9.10.1.40 | 9.10.1.40 |
| cisco adaptive_security_appliance_software | from 9.12, before 9.12.3.9 | 9.12.3.9 |
| cisco adaptive_security_appliance_software | from 9.13, before 9.13.1.10 | 9.13.1.10 |
Exploitation
| In CISA KEV since | 15 Feb 2024 |
|---|---|
| Due date for US federal agencies | 7 Mar 2024 |
| Used in ransomware campaigns | Known |
| Required action | Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. |
Severity
| CVSS 3.1 | 7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NScored by NVD |
|---|---|
| Weakness | CWE-200 |
References
- CVE-2020-3259 on NVD
- CVE-2020-3259 in the CISA KEV catalog
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB (cited by CISA)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3259 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.