Vulnerabilities > CVE-2020-3447 - Information Exposure Through Log Files vulnerability in Cisco products

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

cisco

CWE-532

NVD

Published: 2020-08-17

Updated: 2023-11-07

Summary

A vulnerability in the CLI of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to excessive verbosity in certain log subscriptions. An attacker could exploit this vulnerability by accessing specific log files on an affected device. A successful exploit could allow the attacker to obtain sensitive log data, which may include user credentials. To exploit this vulnerability, the attacker would need to have valid credentials at the operator level or higher on the affected device.

Vulnerable Configurations

Part	Description	Count
Application	Cisco Cisco Content Security Management Appliance - Cisco Content Security Management Appliance 8.3.6-039 Cisco Content Security Management Appliance 9.1.0 Cisco Content Security Management Appliance 9.1.0-031 Cisco Content Security Management Appliance 9.1.0-31 Cisco Content Security Management Appliance 9.1.0-033 Cisco Content Security Management Appliance 9.1.0-103 Cisco Content Security Management Appliance 9.5.0 Cisco Content Security Management Appliance 9.6.0 Cisco Content Security Management Appliance 9.6.6-068 Cisco Content Security Management Appliance 9.7.0-006 Cisco Content Security Management Appliance 10.0.0-203 Cisco Content Security Management Appliance 10.1.0-037 Cisco Content Security Management Appliance 10.1.0-049 Cisco Content Security Management Appliance 11.4.0-812 Cisco Content Security Management Appliance 12.0 Cisco Content Security Management Appliance 12.0.1 Cisco Content Security Management Appliance 12.5.0 Cisco Content Security Management Appliance 12.5.0-436 Cisco Content Security Management Appliance 12.8.1-002 Cisco Content Security Management Appliance 13.0.0-249 Cisco Content Security Management Appliance 13.5.0-114 Cisco Content Security Management Appliance 13.5.0-117 Cisco Content Security Management Appliance 13.6.0 Cisco Content Security Management Appliance 13.6.0-157 Cisco Content Security Management Appliance 13.6.1-193 Cisco Email Security Appliance - Cisco Email Security Appliance 7.1.0 Cisco Email Security Appliance 7.1.1 Cisco Email Security Appliance 7.1.2 Cisco Email Security Appliance 7.1.3 Cisco Email Security Appliance 7.1.4 Cisco Email Security Appliance 7.1.5 Cisco Email Security Appliance 7.3.0 Cisco Email Security Appliance 7.3.1 Cisco Email Security Appliance 7.3.2 Cisco Email Security Appliance 7.5.0 Cisco Email Security Appliance 7.5.1 Cisco Email Security Appliance 7.5.2 Cisco Email Security Appliance 7.5.2-201 Cisco Email Security Appliance 7.5.2-Hp2-303 Cisco Email Security Appliance 7.6.0 Cisco Email Security Appliance 7.6.1-000 Cisco Email Security Appliance 7.6.1-Gpl-022 Cisco Email Security Appliance 7.6.2 Cisco Email Security Appliance 7.6.3-000 Cisco Email Security Appliance 7.6.3-025 Cisco Email Security Appliance 7.7.0-000 Cisco Email Security Appliance 7.7.1-000 Cisco Email Security Appliance 7.8.0 Cisco Email Security Appliance 7.8.0-311 Cisco Email Security Appliance 8.0.1-023 Cisco Email Security Appliance 8.0_Base Cisco Email Security Appliance 8.5.0-000 Cisco Email Security Appliance 8.5.0-Er1-198 Cisco Email Security Appliance 8.5.1-021 Cisco Email Security Appliance 8.5.6-052 Cisco Email Security Appliance 8.5.6-073 Cisco Email Security Appliance 8.5.6-074 Cisco Email Security Appliance 8.5.6-106 Cisco Email Security Appliance 8.5.6-113 Cisco Email Security Appliance 8.5.7-042 Cisco Email Security Appliance 8.6.0 Cisco Email Security Appliance 8.6.0-011 Cisco Email Security Appliance 8.9.0 Cisco Email Security Appliance 8.9.1-000 Cisco Email Security Appliance 8.9.2-032 Cisco Email Security Appliance 9.0.0 Cisco Email Security Appliance 9.0.0-212 Cisco Email Security Appliance 9.0.0-461 Cisco Email Security Appliance 9.0.5-000 Cisco Email Security Appliance 9.1.0 Cisco Email Security Appliance 9.1.0-011 Cisco Email Security Appliance 9.1.0-032 Cisco Email Security Appliance 9.1.0-101 Cisco Email Security Appliance 9.1.1-000 Cisco Email Security Appliance 9.1.1-036 Cisco Email Security Appliance 9.4.0 Cisco Email Security Appliance 9.4.4-000 Cisco Email Security Appliance 9.5.0-000 Cisco Email Security Appliance 9.5.0-201 Cisco Email Security Appliance 9.6.0-000 Cisco Email Security Appliance 9.6.0-042 Cisco Email Security Appliance 9.6.0-051 Cisco Email Security Appliance 9.7.0-125 Cisco Email Security Appliance 9.7.1-066 Cisco Email Security Appliance 9.7.1-Hp2-207 Cisco Email Security Appliance 9.7.2-065 Cisco Email Security Appliance 9.8.5-085 Cisco Email Security Appliance 9.9.6-026 Cisco Email Security Appliance 9.9_Base Cisco Email Security Appliance 10.0.0-203 Cisco Email Security Appliance 10.0.0-232 Cisco Email Security Appliance 10.1.0-049 Cisco Email Security Appliance 11.0.1-Hp5-602 Cisco Email Security Appliance 11.1.0-131 Cisco Email Security Appliance 11.1.0-404 Cisco Email Security Appliance 11.1.2 Cisco Email Security Appliance 11.1.2-023 Cisco Email Security Appliance 11.1.8-076 Cisco Email Security Appliance 12.0.0 Cisco Email Security Appliance 12.0.0-208 Cisco Email Security Appliance 12.0.0-419 Cisco Email Security Appliance 12.5.0 Cisco Email Security Appliance 12.5.0-066 Cisco Email Security Appliance 12.5.1-031 Cisco Email Security Appliance 12.5.1-037 Cisco Email Security Appliance 12.5.3-041 Cisco Email Security Appliance 13.0 Cisco Email Security Appliance 13.0.0 Cisco Email Security Appliance 13.0.0-226 Cisco Email Security Appliance 13.0.0-311 Cisco Email Security Appliance 13.0.0-314 Cisco Email Security Appliance 13.0.0-375 Cisco Email Security Appliance 13.0.0-392 Cisco Email Security Appliance 13.0.1 Cisco Email Security Appliance 13.0.5-007 Cisco Email Security Appliance 13.5.0	118

Common Weakness Enumeration (CWE)

CWE-532 - Information Exposure Through Log Files

Common Attack Pattern Enumeration and Classification (CAPEC)

Fuzzing and observing application log data/errors for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. By observing logs and error messages, the attacker can learn details about the configuration of the target application and might be able to cause the target to disclose sensitive information.

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-log-YxQ6g2kG