NVD - CVE-2020-3259 (original) (raw)
Description
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit this vulnerability by sending a crafted GET request to the web services interface. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.
Metrics
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:
NIST: NVD
NVD assessment not yet provided.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA: Cisco Systems, Inc.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 Severity and Vector Strings:
NIST: NVD
Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)
This CVE is in CISA's Known Exploited Vulnerabilities Catalog
Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.
| Vulnerability Name | Date Added | Due Date | Required Action |
|---|---|---|---|
| Cisco ASA and FTD Information Disclosure Vulnerability | 02/15/2024 | 03/07/2024 | Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information | NIST |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | Cisco Systems, Inc. |
Known Affected Software Configurations Switch to CPE 2.2
Change History
15 change records found show changes
Modified Analysis by NIST 10/28/2025 9:57:45 AM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Reference Type | CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2020-3259 Types: US Government Resource |
CVE Modified by CISA-ADP 10/21/2025 8:17:07 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Reference | https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2020-3259 |
CVE Modified by CISA-ADP 10/21/2025 4🔞02 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Removed | Reference | https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2020-3259 |
CVE Modified by CISA-ADP 10/21/2025 3🔞33 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Reference | https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2020-3259 |
Modified Analysis by NIST 2/24/2025 10:40:35 AM
| Action | Type | Old Value | New Value |
|---|
CVE Modified by CVE 11/21/2024 12:30:40 AM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Reference | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB |
CVE Modified by Cisco Systems, Inc. 5/14/2024 3:10:07 AM
| Action | Type | Old Value | New Value |
|---|
CVE CISA KEV Update by Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government 2/15/2024 9:00:03 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Date Added | 2024-02-15 | |
| Added | Due Date | 2024-03-07 | |
| Added | Required Action | Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | |
| Added | Vulnerability Name | Cisco ASA and FTD Information Disclosure Vulnerability |
CPE Deprecation Remap by NIST 8/16/2023 12:17:07 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Changed | CPE Configuration | OR *cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:* versions from (including) 9.13 from (excluding) 9.13.1.10 | OR *cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* versions from (including) 9.13 from (excluding) 9.13.1.10 |
CPE Deprecation Remap by NIST 8/16/2023 12:17:07 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Changed | CPE Configuration | OR *cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:* versions from (including) 9.12 from (excluding) 9.12.3.9 | OR *cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* versions from (including) 9.12 from (excluding) 9.12.3.9 |
CPE Deprecation Remap by NIST 8/16/2023 12:17:07 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Changed | CPE Configuration | OR *cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:* versions from (including) 9.10 from (excluding) 9.10.1.40 | OR *cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* versions from (including) 9.10 from (excluding) 9.10.1.40 |
CPE Deprecation Remap by NIST 8/16/2023 12:17:07 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Changed | CPE Configuration | OR *cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:* versions from (including) 9.9 from (excluding) 9.9.2.67 | OR *cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* versions from (including) 9.9 from (excluding) 9.9.2.67 |
CPE Deprecation Remap by NIST 8/16/2023 12:17:07 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Changed | CPE Configuration | OR *cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:* versions from (including) 9.8 from (excluding) 9.8.4.20 | OR *cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* versions from (including) 9.8 from (excluding) 9.8.4.20 |
Reanalysis by NIST 9/17/2021 4:00:57 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | CWE | NIST NVD-CWE-noinfo | |
| Removed | CWE | NIST CWE-200 |
Initial Analysis by NIST 5/12/2020 2:53:47 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | CVSS V3.1 | NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | |
| Added | CVSS V2 | NIST (AV:N/AC:L/Au:N/C:P/I:N/A:N) | |
| Added | CWE | NIST CWE-200 | |
| Added | CPE Configuration | OR *cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:* versions from (including) 9.8 up to (excluding) 9.8.4.20 *cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:* versions from (including) 9.9 up to (excluding) 9.9.2.67 *cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:* versions from (including) 9.10 up to (excluding) 9.10.1.40 *cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:* versions from (including) 9.12 up to (excluding) 9.12.3.9 *cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:* versions from (including) 9.13 up to (excluding) 9.13.1.10 *cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* versions from (including) 6.2.3 up to (excluding) 6.2.3.16 *cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* versions from (including) 6.3.0 up to (excluding) 6.3.0.6 *cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* versions from (including) 6.4.0 up to (excluding) 6.4.0.9 *cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* versions from (including) 6.5.0 up to (excluding) 6.5.0.5 | |
| Changed | Reference Type | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB No Types Assigned | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB Vendor Advisory |