CVE-2020-3583: 
Cisco Adaptive Security Appliance (ASA) vulnerability analysis and mitigation

Multiple vulnerabilities were identified in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. These cross-site scripting (XSS) vulnerabilities could be exploited by an unauthenticated, remote attacker. The vulnerability was assigned CVE-2020-3583 and was discovered in December 2019, with public disclosure in October 2020. The issue specifically affects certain AnyConnect and WebVPN configurations (MITRE CVE).

The vulnerability stems from insufficient validation of user-supplied input by the web services interface of affected devices. The issue specifically impacts the web services interface of Cisco ASA Software and Cisco Firepower Threat Defense Software. The vulnerability requires user interaction, as successful exploitation involves persuading a user of the interface to click on a crafted link (NVD Database).

A successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the interface or gain access to sensitive, browser-based information. The impact is specifically concerning for organizations using affected AnyConnect and WebVPN configurations (MITRE CVE).

The vulnerability requires an attacker to persuade a user of the interface to click a crafted link. The attack vector is remote, and no authentication is required for exploitation (NVD Database).

Cisco has released security updates to address these vulnerabilities. Organizations using affected versions of Cisco ASA Software and Cisco Firepower Threat Defense Software should apply the appropriate patches as detailed in the Cisco Security Advisory (Cisco Advisory).