CVE-2020-3547
Last modified
CVE-2020-3547 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), and Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because an insecure method is used to mask certain passwords on the web-based management interface. EPSS estimates a 0.88% chance of exploitation in the next 30 days.
Description
A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), and Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because an insecure method is used to mask certain passwords on the web-based management interface. An attacker could exploit this vulnerability by looking at the raw HTML code that is received from the interface. A successful exploit could allow the attacker to obtain some of the passwords configured throughout the interface.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Asyncos | <= 13.5.1-277 |
| Cisco | Asyncos | <= 13.6.1-193 |
| Cisco | Asyncos | <= 11.7.2-011 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-3547?
How severe is CVE-2020-3547?
How do I fix CVE-2020-3547?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-35464Version 1.3.0 of the Weave Cloud Agent Docker image contains…9.8
- CVE-2020-35465Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2020-35466The Blackfire Docker image through 2020-12-14 contains a bla…9.8
- CVE-2020-35467The Docker Docs Docker image through 2020-12-14 contains a b…9.8
- CVE-2020-35468The Appbase streams Docker image 2.1.2 contains a blank pass…9.8
- CVE-2020-35469The Software AG Terracotta Server OSS Docker image 5.4.1 con…9.8
- CVE-2020-35470Envoy before 1.16.1 logs an incorrect downstream address bec…8.8
- CVE-2020-35471Envoy before 1.16.1 mishandles dropped and truncated datagra…7.5
- CVE-2020-35473An information leakage vulnerability in the Bluetooth Low En…4.3
- CVE-2020-35474In MediaWiki before 1.35.1, the combination of Html::rawElem…6.1
- CVE-2020-35475In MediaWiki before 1.35.1, the messages userrights-expiry-c…7.5
- CVE-2020-35476A remote code execution vulnerability occurs in OpenTSDB thr…9.8
Are you affected by CVE-2020-3547?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST