A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), and Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because an insecure method is used to mask certain passwords on the web-based management interface. An attacker could exploit this vulnerability by looking at the raw HTML code that is received from the interface. A successful exploit could allow the attacker to obtain some of the passwords configured throughout the interface.

According to its self-reported version, the Cisco Web Security Appliance (WSA) is affected by an information disclosure vulnerability in the web-based management interface of Cisco AsyncOS software due to the use of an insecure method to mask certain passwords on the web-based management interface. An authenticated, remote attacker could exploit this by looking at the raw HTML code that is received from the interface. A successful exploit could allow an attacker to obtain some of the passwords configured throughout the interface. 

Please see the included Cisco BIDs and the Cisco Security Advisory for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

According to its self-reported version, the Cisco Content Security Management Appliance (SMA) is affected by an information disclosure vulnerability in the web-based management interface of Cisco AsyncOS software due to the use of an insecure method to mask certain passwords on the web-based management interface. An authenticated, remote attacker could exploit this by looking at the raw HTML code that is received from the interface. A successful exploit could allow an attacker to obtain some of the passwords configured throughout the interface. 

Please see the included Cisco BIDs and the Cisco Security Advisory for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

According to its self-reported version, the Cisco Email Security Appliance (ESA) is affected by an information disclosure vulnerability in the web-based management interface of Cisco AsyncOS software due to the use of an insecure method to mask certain passwords on the web-based management interface. An authenticated, remote attacker could exploit this by looking at the raw HTML code that is received from the interface. A successful exploit could allow an attacker to obtain some of the passwords configured throughout the interface. 

Please see the included Cisco BIDs and the Cisco Security Advisory for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

ID	Name	Product	Family	Severity
140404	Cisco Web Security Appliance (WSA) Information Disclosure (cisco-sa-sma-wsa-esa-info-dis-vsvPzOHP)	Nessus	CISCO	medium
140403	Cisco Content Security Management Appliance (SMA) Information Disclosure (cisco-sa-sma-wsa-esa-info-dis-vsvPzOHP)	Nessus	CISCO	medium
140402	Cisco Email Security Appliance (ESA) Information Disclosure (cisco-sa-sma-wsa-esa-info-dis-vsvPzOHP)	Nessus	CISCO	medium

Detections

Analytics

CVE-2020-3547

medium

Tenable Plugins

medium

medium

medium