CVE-2020-3578

MediumCVSS 6.5/10Last modified Aug 11, 2026

Description

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access rule and access parts of the WebVPN portal that are supposed to be blocked. The vulnerability is due to insufficient validation of URLs when portal access rules are configured. An attacker could exploit this vulnerability by accessing certain URLs on the affected device.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Oct 21, 2020
Last modified: Aug 11, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-357806.5NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service.CVE-2020-357816.5NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service.CVE-2020-357828.1Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0.48, JGS524Ev2 befor CVE-2020-357836.5Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0.48, GS116Ev2 before CVE-2020-357847.2Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0.48, JGS524PE before CVE-2020-357858.8NETGEAR DGN2200v1 devices before v1.0.0.60 mishandle HTTPd authentication (aka PSV-2020-0363, PSV-2020-0364, and PSV-2020-0365).CVE-2020-357864.5NETGEAR R7800 devices before 1.0.2.74 are affected by a buffer overflow by an authenticated user.CVE-2020-357878.0Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.7 CVE-2020-357886.8NETGEAR WAC104 devices before 1.0.4.13 are affected by a buffer overflow by an authenticated user.CVE-2020-357898.8NETGEAR NMS300 devices before 1.6.0.27 are affected by command injection by an authenticated user.CVE-2020-35796.1A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to co CVE-2020-357906.8Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.56, R7800 before 1.0.2.6