CVE-2020-3578
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
A vulnerability in the web services interface of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to bypass a configured access rule and access parts of the WebVPN portal that are supposed to be blocked. The issue is due to insufficient URL validation when portal access rules are configured. An attacker could exploit this by accessing certain URLs on the device.
Risk Assessment
Bypassing access rules could allow unauthorized access to WebVPN resources, potentially compromising data confidentiality and integrity.
Recommendation
It is recommended to update ASA and FTD software to patched versions and review portal access rule configurations.
Original NVD description (English source)
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access rule and access parts of the WebVPN portal that are supposed to be blocked. The vulnerability is due to insufficient validation of URLs when portal access rules are configured. An attacker could exploit this vulnerability by accessing certain URLs on the affected device.