PT-2023-7130 · Cisco · Cisco Asa+1

Damian Poole · Published 2023-10-27 · Updated 2024-01-25 · CVE-2023-20264

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software (affected versions not specified) Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description The issue is related to the implementation of Security Assertion Markup Language (SAML) 2.0 single sign-on (SSO) for remote access VPN in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. It is caused by insufficient validation of the login URL, allowing an unauthenticated, remote attacker to intercept the SAML assertion of a user who is authenticating to a remote access VPN session. This could enable the attacker to establish a remote access VPN session toward the affected device with the identity and permissions of the hijacked user, resulting in access to the protected network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Open Redirect

Weakness Enumeration

CWE-275

CWE-284

CWE-601

Related Identifiers

BDU:2023-08157

CVE-2023-20264

Affected Products

Cisco Asa

Cisco Ftd

References · 7

• https://bdu.fstec.ru/vul/2023-08157 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-20264 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-saml-hijack-ttuQfyz · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-20264 · Vendor Advisory
• https://vuldb.com/?id.244252 · Note
• https://twitter.com/CVEnew/status/1719768436861980942 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2023110237 · Note