CVE-2020-3178: Cisco Content Security Management Appliance Open Redirect Vulnerabilities
First published: Wed May 06 2020(Updated: )
Multiple vulnerabilities in the web-based GUI of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. The vulnerabilities are due to improper input validation of the parameters of an HTTP request. An attacker could exploit these vulnerabilities by intercepting an HTTP request and modifying it to redirect a user to a specific malicious URL. A successful exploit could allow the attacker to redirect a user to a malicious web page or to obtain sensitive browser-based information. This type of attack is commonly referred to as an open redirect attack and is used in phishing attacks to get users to unknowingly visit malicious sites.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Content Security Management Appliance | <13.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-3178?
CVE-2020-3178 is a vulnerability in the web-based GUI of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) that could allow an unauthenticated, remote attacker to redirect a user to a malicious web page.
What is the severity of CVE-2020-3178?
The severity of CVE-2020-3178 is medium with a CVSS score of 6.1.
How does CVE-2020-3178 affect Cisco Content Security Management Appliance?
CVE-2020-3178 affects Cisco Content Security Management Appliance version up to 13.6.0.
What is the CWE category of CVE-2020-3178?
CVE-2020-3178 falls under CWE categories 20 (Improper Input Validation) and 601 (URL Redirection to Untrusted Site ('Open Redirect')).
How can I fix CVE-2020-3178?
To fix CVE-2020-3178, users should update to a version of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) that is not affected by the vulnerability.
- collector/nvd-index
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/severity
- agent/weakness
- agent/title
- agent/author
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/cisco
- canonical/cisco content security management appliance