cve-2020-3153

MEDIUM CVSS 6.5 cisa_known_exploited

Description

Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.

Timeline

Published: 2022-10-24
Last Modified: 2022-10-24

CVSS Details

CVSS details not available.

Affected Products

No product information available.

References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "cvss": 6.5,
  "datePublished": "2022-10-24",
  "dateUpdated": "2022-10-24",
  "description": "Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.",
  "dueDate": "2022-11-14",
  "id": "CVE-2020-3153",
  "kev_catalogs": [
    "cisa"
  ],
  "knownRansomwareCampaignUse": "Known",
  "notes": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-win-path-traverse-qO4HWBsj; https://nvd.nist.gov/vuln/detail/CVE-2020-3153",
  "product": "AnyConnect Secure",
  "requiredAction": "Apply updates per vendor instructions.",
  "severity": "MEDIUM",
  "source": "cisa_known_exploited",
  "title": "Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability",
  "vendor": "Cisco"
}

cve-2020-3153

Raw JSON Data