PT-2020-2234 · Cisco · Cisco Umbrella

Published 2020-05-05 · Updated 2020-05-12 · CVE-2020-3246

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Umbrella (affected versions not specified)

Description The issue is related to insufficient validation of user input in the web server of Cisco Umbrella, which could allow an unauthenticated, remote attacker to perform a carriage return line feed (CRLF) injection attack against a user of an affected service. An attacker could exploit this by persuading a user to access a crafted URL, potentially allowing the injection of arbitrary HTTP headers into valid HTTP responses sent to the user's browser.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

Improper Privilege Management

Weakness Enumeration

CWE-74

CWE-93

CWE-269

Related Identifiers

BDU:2020-02150

CVE-2020-3246

Affected Products

Cisco Umbrella

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-umbrella-head-inject-n4QArJH · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3246 · Security Note
• https://bdu.fstec.ru/vul/2020-02150 · Security Note
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-3246 · Note
• https://t.me/cvenotify/3587 · Telegram Post