PT-2020-2235 · Cisco · Cisco Ftd

Published 2020-05-05 · Updated 2021-10-12 · CVE-2020-3285

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description A logic error in the handling of the Transport Layer Security version 1.3 (TLS 1.3) policy with URL category functionality could allow an unauthenticated, remote attacker to bypass a configured TLS 1.3 policy to block traffic for a specific URL. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted TLS 1.3 connections to an affected device, potentially allowing access to URLs that are normally dropped.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Protection Mechanism Failure

Open Redirect

Weakness Enumeration

CWE-693

CWE-601

Related Identifiers

BDU:2020-02151

CVE-2020-3285

Affected Products

Cisco Ftd

References · 6

• https://osv.dev/vulnerability/CVE-2020-3285 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssl-bypass-O5tGum2n · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3285 · Security Note
• https://bdu.fstec.ru/vul/2020-02151 · Security Note
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-3285 · Note
• https://t.me/cvenotify/3594 · Telegram Post