CVE-2020-3547: Infoleak
First published: Fri Sep 04 2020(Updated: )
A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), and Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because an insecure method is used to mask certain passwords on the web-based management interface. An attacker could exploit this vulnerability by looking at the raw HTML code that is received from the interface. A successful exploit could allow the attacker to obtain some of the passwords configured throughout the interface.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco AsyncOS | <=13.5.1-277 | |
| Cisco Email Security Appliance | ||
| Cisco AsyncOS | <=13.6.1-193 | |
| Cisco Content Security Management Appliance | ||
| Cisco AsyncOS | <=11.7.2-011 | |
| Cisco Web Security Appliance |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-3547 vulnerability?
CVE-2020-3547 is a vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), and Cisco Web Security Appliance (WSA) that allows an authenticated, remote attacker to access sensitive information.
Who is affected by CVE-2020-3547 vulnerability?
Organizations using Cisco AsyncOS software versions up to 13.5.1-277 or 13.6.1-193 for Cisco ESA, SMA, and WSA may be affected.
How can an attacker exploit CVE-2020-3547 vulnerability?
An authenticated, remote attacker can exploit CVE-2020-3547 by accessing the web-based management interface and leveraging the vulnerability to access sensitive information.
What is the severity rating of CVE-2020-3547 vulnerability?
CVE-2020-3547 has a severity rating of 6.5 (medium).
Is there a fix for CVE-2020-3547 vulnerability?
Yes, Cisco has released software updates to address the CVE-2020-3547 vulnerability. Please refer to the Cisco Security Advisory for more information on the available fixes.
- collector/nvd-index
- agent/weakness
- vendor/cisco
- canonical/cisco asyncos
- version/cisco asyncos/13.5.1-277
- canonical/cisco email security appliance
- version/cisco asyncos/13.6.1-193
- canonical/cisco content security management appliance
- version/cisco asyncos/11.7.2-011
- canonical/cisco web security appliance