Information disclosure in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Secure Firewall Threat Defense (FTD) - CVE-2020-3259
Published: May 7, 2020 / Updated: February 1, 2024
Vulnerability identifier: #VU27595
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-3259
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. A remote attacker can send a specially crafted GET request and gain unauthorized access to sensitive information on the system.
Affected software
Cisco Secure Firewall Adaptive Security Appliance (ASA)
Cisco Secure Firewall Threat Defense (FTD)
Cisco Secure Firewall Threat Defense (FTD)
How to mitigate CVE-2020-3259
Vendor recommends to update the Cisco FTD Software Release to version 6.2.3.16 (June 2020), 6.3.0.6 (future release), 6.4.0.9 (May 2020) and 6.5.0.5 (future release).
Cisco Secure Firewall Adaptive Security Appliance (ASA) - addressed in versions 9.8.4.20, 9.9.2.67, 9.10.1.39, 9.12.3.9, 9.13.1.10