CVE-2020-3432 (CNNVD-202007-074)
中文标题:
Cisco AnyConnect Secure Mobility Client for Mac OS 后置链接漏洞
英文标题:
Cisco AnyConnect Secure Mobility Client for Mac OS File Corruption Vulnerability
漏洞描述
中文描述:
Cisco AnyConnect Secure Mobility Client for Mac OS是美国思科（Cisco）公司的一款基于Mac OS平台的可通过任何设备安全访问网络和应用的安全移动客户端。 Cisco AnyConnect Secure Mobility Client for Mac OS 4.9.00086之前版本中的卸载程序组件存在后置链接漏洞，该漏洞源于程序未正确处理目录路径。攻击者可通过在特定路径上创建指向目标文件的符号链接利用该漏洞破坏文件的内容，进而导致拒绝服务。
英文描述:
A vulnerability in the uninstaller component of Cisco AnyConnect Secure Mobility Client for Mac OS could allow an authenticated, local attacker to corrupt the content of any file in the filesystem. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a symbolic link (symlink) to a target file on a specific path. A successful exploit could allow the attacker to corrupt the contents of the file. If the file is a critical systems file, the exploit could lead to a denial of service condition. To exploit this vulnerability, the attacker would need to have valid credentials on the system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Cisco | Cisco Secure Client | N/A | - | - |
cpe:2.3:a:cisco:cisco_secure_client:n_a:*:*:*:*:*:*:*
|
| cisco | anyconnect_secure_mobility_client | * | - | - |
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:macos:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
3.0 (cna)
MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H/E:X/RL:X/RC:X
3.1 (adp)
MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2020-3432 |
2025-11-11 15:20:37 | 2025-11-11 07:36:19 |
| NVD | nvd_CVE-2020-3432 |
2025-11-11 14:57:13 | 2025-11-11 07:44:43 |
| CNNVD | cnnvd_CNNVD-202007-074 |
2025-11-11 15:12:02 | 2025-11-11 07:56:21 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 后置链接
- cnnvd_id: 未提取 -> CNNVD-202007-074
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']