{"cve_id":"CVE-2020-3580","published":"2020-10-21T19:15:18.607000+00:00","last_modified":"2026-08-11T19:42:47.633000+00:00","vuln_status":"Analyzed","description":"Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.","cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","base_score":6.1,"base_severity":"MEDIUM","attack_vector":"NETWORK","privileges_req":"NONE","user_interaction":"REQUIRED","scope":"CHANGED","impact_c":"LOW","impact_i":"LOW","impact_a":"NONE","cwe_ids":["CWE-79"],"in_kev":true,"kev_date_added":"2021-11-03","kev_ransomware":true,"epss_score":0.85575,"epss_percentile":0.99724,"cap_rule_version":"0.1.1","stage":"CRED_ACCESS","req_access":"NONE","req_vector":"NETWORK","req_user_interaction":true,"grant_access":"NONE","caps":["CRED_ACCESS","INFO_DISCLOSURE","TAMPER"],"terminal":false,"cap_confidence":"high","ingested_at":"2026-09-18T09:26:01.594530+00:00","first_seen":"2020-10-21T19:15:18.607000+00:00","kev_first_seen":"2021-11-03T00:00:00+00:00","novelty_score":0.0,"novelty_reasons":[],"novelty_at":null,"vendors":["cisco"],"products":["adaptive_security_appliance_software","secure_firewall_threat_defense"],"affected":[{"vendor":"cisco","product":"adaptive_security_appliance_software","ranges":["≥ 9.15 and < 9.15.1.15","≥ 9.10 and < 9.12.4.13","≥ 9.13 and < 9.13.1.21","≥ 9.14 and < 9.14.2.8","< 9.8.4.34","≥ 9.9 and < 9.9.2.85"]},{"vendor":"cisco","product":"secure_firewall_threat_defense","ranges":["≥ 6.5.0 and < 6.6.4","≥ 6.7.0 and < 6.7.0.2","< 6.4.0.12"]}]}