8.8

CVE-2020-3456

Cisco FXOS Software Firepower Chassis Manager Cross-Site Request Forgery Vulnerability

A vulnerability in the Cisco Firepower Chassis Manager (FCM) of Cisco FXOS Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of an affected device. The vulnerability is due to insufficient CSRF protections for the FCM interface. An attacker could exploit this vulnerability by persuading a targeted user to click a malicious link. A successful exploit could allow the attacker to send arbitrary requests that could take unauthorized actions on behalf of the targeted user.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Firepower Extensible Operating System Version 2.4(1.249)
   Cisco ≫ Firepower 4110 Version -
   Cisco ≫ Firepower 4112 Version -
   Cisco ≫ Firepower 4115 Version -
   Cisco ≫ Firepower 4120 Version -
   Cisco ≫ Firepower 4125 Version -
   Cisco ≫ Firepower 4140 Version -
   Cisco ≫ Firepower 4145 Version -
   Cisco ≫ Firepower 4150 Version -
   Cisco ≫ Firepower 9300 Sm-24 Version -
   Cisco ≫ Firepower 9300 Sm-36 Version -
   Cisco ≫ Firepower 9300 Sm-40 Version -
   Cisco ≫ Firepower 9300 Sm-44 Version -
   Cisco ≫ Firepower 9300 Sm-44 X 3 Version -
   Cisco ≫ Firepower 9300 Sm-48 Version -
   Cisco ≫ Firepower 9300 Sm-56 Version -
   Cisco ≫ Firepower 9300 Sm-56 X 3 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.56% 0.426
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
Cisco PSIRT 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fxosfcm-csrf-uhO4e5BZ
Patch
Vendor Advisory