CVE-2020-3187 Path traversal in Cisco Adaptive Security Appliance (ASA) Software
Unauthenticated attackers can read or delete files in the web services filesystem if WebVPN or AnyConnect is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-3187?
CVE-2020-3187 is a critical path traversal vulnerability in Cisco Adaptive Security Appliance Software, published on 6 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences. An exploit could allow the attacker to view or delete arbitrary files on the targeted system. When the device is reloaded after exploitation of this vulnerability, any files that were deleted are restored. The attacker can only view and delete files within the web services file system. This file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability can not be used to obtain access to ASA or FTD system files or underlying operating system (OS) files. Reloading the affected device will restore all files within the web services file system.
Weakness: CWE-22
Which versions are affected by CVE-2020-3187?
It affects 14 products.
Products include Cisco Adaptive Security Appliance Software, Cisco Asa 5505 Firmware, Cisco Asa 5510 Firmware, Cisco Asa 5512-X Firmware, Cisco Asa 5515-X Firmware, Cisco Asa 5520 Firmware and 8 more.
How do I fix CVE-2020-3187?
No fix has been published for CVE-2020-3187 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-3187 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-3187 exists.
Public exploit code: 1 Exploit-DB entry, 1 Nuclei template and 5 proofs of concept on GitHub.
Other vulnerabilities in Cisco Adaptive Security Appliance Software
- CVE-2025-20333 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow
- CVE-2016-6366 Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow
- CVE-2026-20349 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection
- CVE-2024-20353 Cisco ASA and FTD Denial of Service
- CVE-2016-6367 Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution
All Cisco Adaptive Security Appliance Software vulnerabilities
Sources
Also known as GHSA-5f48-6vm9-w28v.