A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a configured rule, allowing traffic onto a network that should have been blocked.

This vulnerability is due to improper detection of malicious traffic when the traffic is encoded with a specific content format. An attacker could exploit this vulnerability by using an affected device to connect to a malicious server and receiving crafted HTTP responses. A successful exploit could allow the attacker to bypass an explicit block rule and receive traffic that should have been rejected by the device.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00065.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Cisco Cisco Secure Web Appliance affected
Version Status Constraints
11.7.0-406 affected —
11.7.0-418 affected —
11.7.1-049 affected —
11.7.1-006 affected —
11.7.1-020 affected —
11.7.2-011 affected —
11.8.0-414 affected —
11.8.1-023 affected —
11.8.3-018 affected —
11.8.3-021 affected —
12.0.1-268 affected —
12.0.3-007 affected —
12.5.2-007 affected —
12.5.1-011 affected —
12.5.4-005 affected —
12.5.5-004 affected —
14.5.0-498 affected —
14.5.1-016 affected —
14.0.3-014 affected —
14.0.2-012 affected —
14.0.4-005 affected —

Configuration 1 [-]

AND
OR cpe:2.3:o:cisco:asyncos:11.7.0-406:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:11.7.0-418:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:11.7.1-006:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:11.7.1-020:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:11.7.1-049:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:11.7.2-011:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:11.8.0-414:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:11.8.1-023:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:11.8.3-018:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:11.8.3-021:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:12.0.1-268:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:12.0.3-007:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:12.5.1-011:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:12.5.2-007:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:12.5.4-005:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:12.5.5-004:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:14.0.2-012:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:14.0.3-014:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:14.0.4-005:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:14.5.0-498:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:14.5.1-008:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:14.5.1-016:*:*:*:*:*:*:*
OR cpe:2.3:h:cisco:s195:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:s395:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:s695:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:web_security_appliance_s170:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:web_security_appliance_s190:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:web_security_appliance_s380:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:web_security_appliance_s390:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:web_security_appliance_s680:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:web_security_appliance_s690:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:web_security_appliance_s690x:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Cisco Subscribe
Asyncos Subscribe
S195 Subscribe
S395 Subscribe
S695 Subscribe
Web Security Appliance S170 Subscribe
Web Security Appliance S190 Subscribe
Web Security Appliance S380 Subscribe
Web Security Appliance S390 Subscribe
Web Security Appliance S680 Subscribe
Web Security Appliance S690 Subscribe
Web Security Appliance S690x Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2023-24394 A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a configured rule, allowing traffic onto a network that should have been blocked. This vulnerability is due to improper detection of malicious traffic when the traffic is encoded with a specific content format. An attacker could exploit this vulnerability by using an affected device to connect to a malicious server and receiving crafted HTTP responses. A successful exploit could allow the attacker to bypass an explicit block rule and receive traffic that should have been rejected by the device.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-bypass-vXvqwzsj cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2024-08-02T09:05:35.594Z

Reserved: 2022-10-27T18:47:50.368Z

Link: CVE-2023-20215

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2023-08-03T22:15:11.513

Modified: 2024-11-21T07:40:54.337

Link: CVE-2023-20215

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses