Cisco AnyConnect Uncontrolled Search Path Vulnerability (CVE-2020-3153) Advisory

Critical Vulnerability Information Vulnerability Overview Vulnerability Type: Uncontrolled Search Path Vulnerability CVSS Score: 6.5 (Medium) CVE: CVE-2020-3153 CWE: CWE-427 Cisco Bug ID: CSCvs46327 Security Advisory ID: cisco-sa-ac-win-path-traverse-q04HWBsj Affected Products Affected Product: Cisco AnyConnect Secure Mobility Client for Windows (versions prior to 4.8.02042) Confirmed Unaffected Products: Only products listed in the affected product list are impacted by this vulnerability. Workarounds Workarounds: No workarounds are available to mitigate this vulnerability. Fixed Software Fixed Version: Cisco AnyConnect Secure Mobility Client for Windows version 4.8.02042 and later include the fix for this vulnerability. Exploitation and Public Disclosure October 2022: Cisco PSIRT became aware of additional exploitation attempts of this vulnerability in the wild. Cisco strongly recommends customers upgrade to a version containing the fix to mitigate this vulnerability. Source Reported by Yorick Koster, submitted via the SSD Security Disclosure program. Timeline Initial Release: February 19, 2020 Last Updated: October 25, 2022 Additional Information Link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-win-path-traverse-q04HWBsj

Goal Reached Thanks to every supporter — we hit 100%!

Cisco AnyConnect Uncontrolled Search Path Vulnerability (CVE-2020-3153) Advisory