CVE-2020-3178

published 2020-05-06

CVE-2020-3178: Multiple vulnerabilities in the web-based GUI of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) could allow an unauthenticated…

Priority P4 27 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

Multiple vulnerabilities in the web-based GUI of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. The vulnerabilities are due to improper input validation of the parameters of an HTTP request. An attacker could exploit these vulnerabilities by intercepting an HTTP request and modifying it to redirect a user to a specific malicious URL. A successful exploit could allow the attacker to redirect a user to a malicious web page or to obtain sensitive browser-based information. This type of attack is commonly referred to as an open redirect attack and is used in phishing attacks to get users to unknowingly visit malicious sites.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_content_security_management_appliance	—	—
cisco	content_security_management_appliance	< 13.6.0	13.6.0
cisco	content_security_management_appliance_open_redirect	—	—
linux	linux_kernel	>= 0 < 4.15.0-137.141	4.15.0-137.141

CVSS provenance

nvd v3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvd v3.0 6.1 MEDIUM CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 5.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:N

osv 6.7 MEDIUM

vendor_cisco 6.1 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-601