CVE-2020-3456 Cisco FXOS Software Firepower Chassis Manager Cross-Site Request Forgery Vulnerability
An unauthenticated remote attacker can perform unauthorized actions on behalf of a user via CSRF in Cisco FXOS Firepower Chassis Manager.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-3456?
CVE-2020-3456 is a high-severity vulnerability in Cisco Firepower Extensible Operating System, published on 21 Oct 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in the Cisco Firepower Chassis Manager (FCM) of Cisco FXOS Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of an affected device. The vulnerability is due to insufficient CSRF protections for the FCM interface. An attacker could exploit this vulnerability by persuading a targeted user to click a malicious link. A successful exploit could allow the attacker to send arbitrary requests that could take unauthorized actions on behalf of the targeted user.
Weakness: CWE-352
Which versions are affected by CVE-2020-3456?
It affects 1 product.
Products include Cisco Firepower Extensible Operating System.
How do I fix CVE-2020-3456?
No fix has been published for CVE-2020-3456 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-3456 being exploited?
There is no known exploitation of CVE-2020-3456 in the wild and no public exploit code.
Other vulnerabilities in Cisco Firepower Extensible Operating System
- CVE-2018-0310 Information disclosure in Cisco FXOS and NX-OS unknown
- CVE-2015-6435 Command injection in n/a
- CVE-2021-1368 Memory corruption in Cisco NX-OS Software
- CVE-2020-3172 Cisco FXOS and NX-OS Software Cisco Discovery Protocol Arbitrary Code Execution and Denial of Service Vulnerability
- CVE-2018-0395 Cisco FXOS and NX-OS Software Link Layer Discovery Protocol Denial of Service Vulnerability
All Cisco Firepower Extensible Operating System vulnerabilities
Sources
Also known as GHSA-327p-j9g4-qf3q.