CVE-2020-3436

CWE-434 — Unrestricted File Upload4 documents4 sources
Severity
8.6HIGH
EPSS
2.1%
top 15.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Cisco Adaptive Security ApplianceCisco Adaptive Security Appliance SoftwareCisco Firepower Threat Defense+1 more
Timeline
PublishedOct 21
Latest updateMay 24

Description

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to upload arbitrary-sized files to specific folders on an affected device, which could lead to an unexpected device reload. The vulnerability exists because the affected software does not efficiently handle the writing of large files to specific folders on the local file system. An attacker could exploit this vu…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HExploitability: 3.9 | Impact: 4.0

Affected Packages4 packages

▶NVDcisco/firepower_threat_defense6.3.0 — 6.3.0.6+4

🔴Vulnerability Details

2
GHSA
GHSA-w8jp-qw34-jrrq: A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) Software could allow↗2022-05-24
▶
CVEList
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services File Upload Denial of Service Vulnerability↗2020-10-21
▶

📋Vendor Advisories

1
Cisco
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services File Upload Denial of Service Vulnerability↗2020-10-21
▶
CVE-2020-3436 (HIGH CVSS 8.6) | A vulnerability in the web services | cvebase.io