CVE-2020-3187 (CNNVD-202005-206)

CRITICAL 有利用代码
中文标题:
Cisco Firepower Threat Defense和Adaptive Security Appliances Software 路径遍历漏洞
英文标题:
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Path Traversal Vulnerability
CVSS分数: 9.1
发布时间: 2020-05-06 16:41:01
漏洞类型: 路径遍历
状态: PUBLISHED
数据质量分数: 0.30
数据版本: v4
漏洞描述
中文描述:

Cisco Firepower Threat Defense（FTD）和Cisco Adaptive Security Appliances Software（ASA Software）都是美国思科（Cisco）公司的产品。Cisco Firepower Threat Defense是一套提供下一代防火墙服务的统一软件。Cisco Adaptive Security Appliances Software是一套防火墙和网络安全平台。该平台提供了对数据和网络资源的高度安全的访问等功能。 Cisco ASA Software和FTD Software中的Web服务接口存在路径遍历漏洞，该漏洞源于程序没有对HTTP URL进行正确的输入验证。远程攻击者可通过发送带有目录遍历序列的特制HTTP请求利用该漏洞读取并删除系统上的敏感信息。

英文描述:

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences. An exploit could allow the attacker to view or delete arbitrary files on the targeted system. When the device is reloaded after exploitation of this vulnerability, any files that were deleted are restored. The attacker can only view and delete files within the web services file system. This file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability can not be used to obtain access to ASA or FTD system files or underlying operating system (OS) files. Reloading the affected device will restore all files within the web services file system.

CWE类型:
CWE-22
标签:
webapps hardware 0xmmnbassel
受影响产品
厂商 产品 版本 版本范围 平台 CPE
Cisco Cisco Adaptive Security Appliance (ASA) Software n/a - - cpe:2.3:a:cisco:cisco_adaptive_security_appliance_(asa)_software:n_a:*:*:*:*:*:*:*
cisco firepower_threat_defense * - - cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*
cisco asa_5505_firmware 9.6\(4\) - - cpe:2.3:o:cisco:asa_5505_firmware:9.6\(4\):*:*:*:*:*:*:*
cisco asa_5510_firmware 9.6\(4\) - - cpe:2.3:o:cisco:asa_5510_firmware:9.6\(4\):*:*:*:*:*:*:*
cisco asa_5512-x_firmware 9.6\(4\) - - cpe:2.3:o:cisco:asa_5512-x_firmware:9.6\(4\):*:*:*:*:*:*:*
cisco asa_5515-x_firmware 9.6\(4\) - - cpe:2.3:o:cisco:asa_5515-x_firmware:9.6\(4\):*:*:*:*:*:*:*
cisco asa_5520_firmware 9.6\(4\) - - cpe:2.3:o:cisco:asa_5520_firmware:9.6\(4\):*:*:*:*:*:*:*
cisco asa_5525-x_firmware 9.6\(4\) - - cpe:2.3:o:cisco:asa_5525-x_firmware:9.6\(4\):*:*:*:*:*:*:*
cisco asa_5540_firmware 9.6\(4\) - - cpe:2.3:o:cisco:asa_5540_firmware:9.6\(4\):*:*:*:*:*:*:*
cisco asa_5545-x_firmware 9.6\(4\) - - cpe:2.3:o:cisco:asa_5545-x_firmware:9.6\(4\):*:*:*:*:*:*:*
cisco asa_5550_firmware 9.6\(4\) - - cpe:2.3:o:cisco:asa_5550_firmware:9.6\(4\):*:*:*:*:*:*:*
cisco asa_5555-x_firmware 9.6\(4\) - - cpe:2.3:o:cisco:asa_5555-x_firmware:9.6\(4\):*:*:*:*:*:*:*
cisco asa_5580_firmware 9.6\(4\) - - cpe:2.3:o:cisco:asa_5580_firmware:9.6\(4\):*:*:*:*:*:*:*
cisco asa_5585-x_firmware 9.6\(4\) - - cpe:2.3:o:cisco:asa_5585-x_firmware:9.6\(4\):*:*:*:*:*:*:*
cisco adaptive_security_appliance_software * - - cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
20200506 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Path Traversal Vulnerability vendor-advisory
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
ExploitDB EDB-48723 EXPLOIT
exploitdb
访问
Download Exploit EDB-48723 EXPLOIT
exploitdb
访问
CVE Reference: CVE-2020-3187 ADVISORY
cve.org
访问
CVSS评分详情
3.0 (cna)
CRITICAL
9.1
CVSS向量: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
机密性
HIGH
完整性
HIGH
可用性
NONE
时间信息
发布时间:
2020-05-06 16:41:01
修改时间:
2024-11-15 17:25:50
创建时间:
2025-11-11 15:36:18
更新时间:
2025-11-11 16:55:05
利用信息
此漏洞有可利用代码！
利用代码数量: 1
利用来源:
未知
数据源详情
数据源 记录ID 版本 提取时间
CVE cve_CVE-2020-3187 2025-11-11 15:20:36 2025-11-11 07:36:18
NVD nvd_CVE-2020-3187 2025-11-11 14:56:58 2025-11-11 07:44:43
CNNVD cnnvd_CNNVD-202005-206 2025-11-11 15:10:25 2025-11-11 07:56:07
EXPLOITDB exploitdb_EDB-48723 2025-11-11 15:05:22 2025-11-11 08:55:05
版本与语言
当前版本: v4
主要语言: EN
支持语言:
EN ZH
其他标识符:
:
:
安全公告
暂无安全公告信息
变更历史
v4 EXPLOITDB
2025-11-11 16:55:05
references_count: 2 → 5; tags_count: 0 → 3; data_sources: ['cnnvd', 'cve', 'nvd'] → ['cnnvd', 'cve', 'exploitdb', 'nvd']
查看详细变更
  • references_count: 2 -> 5
  • tags_count: 0 -> 3
  • data_sources: ['cnnvd', 'cve', 'nvd'] -> ['cnnvd', 'cve', 'exploitdb', 'nvd']
v3 CNNVD
2025-11-11 15:56:07
vulnerability_type: 未提取 → 路径遍历; cnnvd_id: 未提取 → CNNVD-202005-206; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
  • vulnerability_type: 未提取 -> 路径遍历
  • cnnvd_id: 未提取 -> CNNVD-202005-206
  • data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2 NVD
2025-11-11 15:44:43
affected_products_count: 1 → 15; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
  • affected_products_count: 1 -> 15
  • data_sources: ['cve'] -> ['cve', 'nvd']