CVE-2020-3546

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to insufficient validation of requests that are sent to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the interface of an affected device. A successful exploit could allow the attacker to obtain the IP addresses that are configured on the internal interfaces of the affected device. There is a workaround that addresses this vulnerability.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Sep 4, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-354605.3common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writin CVE-2020-354629.8Version 3.16.0 of the CoScale agent Docker image contains a blank password for the root user. Systems deployed using affected versions of th CVE-2020-354639.8Version 1.0.0 of the Instana Dynamic APM Docker image contains a blank password for the root user. Systems deployed using affected versions CVE-2020-354649.8Version 1.3.0 of the Weave Cloud Agent Docker image contains a blank password for the root user. Systems deployed using affected versions of CVE-2020-354669.8The Blackfire Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affected versions of the B CVE-2020-354679.8The Docker Docs Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affected versions of the CVE-2020-354689.8The Appbase streams Docker image 2.1.2 contains a blank password for the root user. Systems deployed using affected versions of the streams CVE-2020-354699.8The Software AG Terracotta Server OSS Docker image 5.4.1 contains a blank password for the root user. Systems deployed using affected versio CVE-2020-35476.5A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Secu CVE-2020-354708.8Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the p CVE-2020-354717.5Envoy before 1.16.1 mishandles dropped and truncated datagrams, as demonstrated by a segmentation fault for a UDP packet size larger than 15 CVE-2020-354734.3An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5.