CVE-2020-3582: 
Cisco Adaptive Security Appliance (ASA) vulnerability analysis and mitigation

Multiple cross-site scripting (XSS) vulnerabilities were discovered in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. The vulnerability (CVE-2020-3582) was disclosed and patched in October 2020, with a CVSS score of 6.1. The flaw specifically affects certain AnyConnect and WebVPN configurations (CISCO Advisory).

The vulnerability stems from insufficient validation of user-supplied input by the web services interface of affected devices. The flaw affects specific configurations including AnyConnect IKEv2 Remote Access with client services and SSL VPN configurations. The vulnerability received a CVSS score of 6.1, indicating moderate severity (Tenable Blog).

A successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the interface or gain access to sensitive, browser-based information. The attack requires user interaction, specifically requiring a user of the interface to click on a crafted link (Help Net Security).

The vulnerability requires user interaction for successful exploitation, as an attacker would need to persuade a user of the interface to click a specially crafted link. The flaw is remotely exploitable without authentication, though its moderate severity rating is due to the requirement for user interaction (MITRE CVE).

Cisco released security patches in October 2020 to address this vulnerability. Organizations using affected Cisco ASA or FTD software are advised to implement the security updates provided by Cisco (CISCO Advisory).