Description

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system.

Remediation

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

References

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability

Related Vulnerabilities

MediaWiki Improper Input Validation Vulnerability (CVE-2011-1580)

WordPress Plugin User Photo 'user-photo.php' Arbitrary File Upload (0.9.4)

WordPress Plugin Photo Gallery by 10Web-Mobile-Friendly Image Gallery Directory Traversal (1.3.42)

WordPress 5.5.x Directory Traversal (5.5 - 5.5.14)

WordPress Duplicator plugin Unauthenticated Arbitrary File Download

Severity

High

Classification

CVE-2020-3452 CWE-20 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Directory Traversal