CVE-2020-3561
MediumCVSS 4.7Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
A vulnerability in the Clientless SSL VPN (WebVPN) of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to inject arbitrary HTTP headers in responses. The issue is due to improper input sanitization. An attacker could exploit this by persuading a user to click a crafted link, enabling CRLF injection and redirecting users to arbitrary websites.
Risk Assessment
CRLF injection could lead to manipulation of system responses, potentially redirecting users to malicious sites and undermining trust in the system.
Recommendation
It is recommended to update ASA and FTD software to patched versions and educate users about clicking suspicious links.
Original NVD description (English source)
A vulnerability in the Clientless SSL VPN (WebVPN) of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to inject arbitrary HTTP headers in the responses of the affected system. The vulnerability is due to improper input sanitization. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to conduct a CRLF injection attack, adding arbitrary HTTP headers in the responses of the system and redirecting the user to arbitrary websites.