PT-2020-3850 · Cisco · Cisco Email Security Appliance+3

Published 2020-09-03 · Updated 2020-09-16 · CVE-2020-3547

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), and Cisco Web Security Appliance (WSA) (affected versions not specified)

Description: A vulnerability in the web-based management interface of the affected software could allow an authenticated, remote attacker to access sensitive information on an affected device. The issue exists due to an insecure method used to mask certain passwords on the web-based management interface. An attacker could exploit this by examining the raw HTML code received from the interface, potentially obtaining some of the passwords configured throughout the interface.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Insufficiently Protected Credentials

Weakness Enumeration

CWE-200

CWE-522

Related Identifiers

BDU:2020-04212

CVE-2020-3547

Affected Products

Cisco Asyncos

Cisco Content Security Management Appliance

Cisco Email Security Appliance

Cisco Web Security Appliance

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-3547 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-wsa-esa-info-dis-vsvPzOHP · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3547 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04212 · Security Note