High · published July 23, 2020
CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.
🚨 A crafty attacker can send a simple request to exploit this vulnerability! The absence of input validation on Cisco ASA and FTD devices could let them pull sensitive files right from your web services interface. 🔥 Think of this like a delivery person who knows how to use a secret back door to access restricted areas of a warehouse—just a well-crafted request can let them waltz right in and peek at files they shouldn’t see. If exploited, an attacker could access sensitive files on your device's web services file system, potentially exposing your organization to serious data leaks. While they can't touch ASA or FTD system files, the risk of revealing sensitive information is absolutely devastating! ⚡
Think of this like a delivery person who knows how to use a secret back door to access restricted areas of a warehouse—just a well-crafted request can let them waltz right in and peek at files they shouldn’t see. This vulnerability arises from improper input validation in HTTP requests, allowing directory traversal attacks, which can expose arbitrary files on the affected Cisco devices when WebVPN or AnyConnect features are enabled.
If exploited, an attacker could access sensitive files on your device's web services file system, potentially exposing your organization to serious data leaks. While they can't touch ASA or FTD system files, the risk of revealing sensitive information is absolutely devastating! ⚡ To protect your systems, patch to the latest version of Cisco ASA or FTD software immediately. Ensure your configurations don’t expose web service interfaces unnecessarily, and regularly review access controls. You've got this! Secure your devices, and you'll be one step closer to becoming a security hero! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| cisco/adaptive_security_appliance_software | ≥ 9.6, < 9.6.4.42 | 9.6.4.42 |
| cisco/adaptive_security_appliance_software | ≥ 9.8, < 9.8.4.20 | 9.8.4.20 |
| cisco/adaptive_security_appliance_software | ≥ 9.9, < 9.9.2.74 | 9.9.2.74 |
| cisco/adaptive_security_appliance_software | ≥ 9.10, < 9.10.1.42 | 9.10.1.42 |
| cisco/adaptive_security_appliance_software | ≥ 9.12, < 9.12.3.12 | 9.12.3.12 |
| cisco/adaptive_security_appliance_software | ≥ 9.13, < 9.13.1.10 | 9.13.1.10 |
| cisco/adaptive_security_appliance_software | ≥ 9.14, < 9.14.1.10 | 9.14.1.10 |
| cisco/secure_firewall_threat_defense | ≥ 6.2.3, < 6.2.3.16 | 6.2.3.16 |
| cisco/secure_firewall_threat_defense | ≥ 6.3.0, < 6.3.0.6 | 6.3.0.6 |
| cisco/secure_firewall_threat_defense | ≥ 6.4.0, < 6.4.0.10 | 6.4.0.10 |
| cisco/secure_firewall_threat_defense | ≥ 6.5.0, < 6.5.0.5 | 6.5.0.5 |
| cisco/secure_firewall_threat_defense | ≥ 6.6.0, < 6.6.0.1 | 6.6.0.1 |