CVE-2020-3547
published 2020-09-04CVE-2020-3547: A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Security Management…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.88%
58.6th percentile
A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), and Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because an insecure method is used to mask certain passwords on the web-based management interface. An attacker could exploit this vulnerability by looking at the raw HTML code that is received from the interface. A successful exploit could allow the attacker to obtain some of the passwords configured throughout the interface.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | asyncos | <= 13.5.1-277 | — |
| cisco | asyncos | <= 13.6.1-193 | — |
| cisco | asyncos | <= 11.7.2-011 | — |
| cisco | cisco_web_security_appliance | — | — |
| cisco | content_security_management_appliance_and_cisco_web_security_appliance | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_cisco4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Content Security Management Appliance and Cisco Web Security Appliance Information Disclosure Vulnerability
vendor_cisco·2020-09-02·CVSS 4.3
CVE-2020-3547 [MEDIUM] CWE-200 Cisco Content Security Management Appliance and Cisco Web Security Appliance Information Disclosure Vulnerability
Cisco Content Security Management Appliance and Cisco Web Security Appliance Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) and Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to access sensitive information on an affected device.
The vulnerability exists because an insecure method is used to mask certain passwords on the web-based management interface. An attacker could exploit this vulnerability by looking at the raw HTML code that is received from the interface. A successful exploit could allow the attacker to obtain some of the passwords configured throughout the interface.
Cisco has released software updates that address this vu
Cisco
Cisco Content Security Management Appliance and Cisco Web Security Appliance Information Disclosure Vulnerability
vendor_cisco·CVSS 3.1
CVE-2020-3547 Cisco Content Security Management Appliance and Cisco Web Security Appliance Information Disclosure Vulnerability
CVE-2020-3547: Cisco Content Security Management Appliance and Cisco Web Security Appliance Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) and Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because an insecure method is used to mask certain passwords on the web-based management interface. An attacker could exploit this vulnerability by looking at the raw HTML code that is received from the interface. A successful exploit could allow the attacker to obtain some of the passwords configured throughout the interface. Cisco has released software updates that ad
GHSA
GHSA-5hr4-4h3v-pvc5: A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Security Manag
ghsa_unreviewed·2022-05-24
CVE-2020-3547 [MEDIUM] GHSA-5hr4-4h3v-pvc5: A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Security Manag
A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), and Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because an insecure method is used to mask certain passwords on the web-based management interface. An attacker could exploit this vulnerability by looking at the raw HTML code that is received from the interface. A successful exploit could allow the attacker to obtain some of the passwords configured throughout the interface.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-09-04
Published