CVE-2020-3452

설명

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attac...

영향 제품·버전

공급사 Cisco

제품 Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)

영향 버전 unspecified, >= 9.6 < 9.6.4.42, >= 9.8 < 9.8.4.20, >= 9.9 < 9.9.2.74, >= 9.10 < 9.10.1.42, >= 9.12 < 9.12.3.12, >= 9.13 < 9.13.1.10, >= 9.14 < 9.14.1.10, >= 6.2.3 < 6.2.3.16, >= 6.3.0 < 6.3.0.6, >= 6.4.0 < 6.4.0.10, >= 6.5.0 < 6.5.0.5, >= 6.6.0 < 6.6.0.1

수정 버전 9.6.4.42, 9.8.4.20, 9.9.2.74, 9.10.1.42, 9.12.3.12, 9.13.1.10, 9.14.1.10, 6.2.3.16, 6.3.0.6, 6.4.0.10, 6.5.0.5, 6.6.0.1

조치 방법

• 공급사가 제공한 최신 보안 업데이트 적용
• 자사 보유 제품과 영향 버전의 일치 여부 확인
• 외부 노출 서비스와 비정상 인증·접속 로그 점검
• 패치가 어려우면 공급사 완화조치와 접근통제 적용

기술 정보

CVSS 벡터 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE CWE-20, CWE-22

KEV 등록일 2021.11.03

랜섬웨어 캠페인 사용 미확인

CISA 비고 https://nvd.nist.gov/vuln/detail/CVE-2020-3452

EPSS 데이터 기준일 2026.06.27