CVE-2020-3285
MediumCVSS 5.8Exploitation Probability (EPSS)
Elevated risk70th percentile - higher than 70% of all known CVEs
Summary
A vulnerability in the TLS 1.3 policy with URL category functionality for Cisco FTD Software could allow an unauthenticated, remote attacker to bypass a configured TLS 1.3 policy to block traffic for a specific URL. The issue is due to a logic error with Snort handling of the connection with the TLS 1.3 policy and URL category configuration. An attacker could exploit this by sending crafted TLS 1.3 connections, bypassing the policy and accessing URLs that would normally be dropped.
Risk Assessment
The risk is that security policies could be bypassed, allowing access to blocked resources, potentially leading to policy violations and security threats.
Recommendation
It is recommended to upgrade FTD software to a patched version and review TLS 1.3 policy and URL category configurations.
Original NVD description (English source)
A vulnerability in the Transport Layer Security version 1.3 (TLS 1.3) policy with URL category functionality for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured TLS 1.3 policy to block traffic for a specific URL. The vulnerability is due to a logic error with Snort handling of the connection with the TLS 1.3 policy and URL category configuration. An attacker could exploit this vulnerability by sending crafted TLS 1.3 connections to an affected device. A successful exploit could allow the attacker to bypass the TLS 1.3 policy and access URLs that are outside the affected device and normally would be dropped.