description: A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance, formerly known as Cisco Web Security Appliance (WSA), could allow an unauthenticated, remote attacker to bypass a configured rule, thereby allowing traffic onto a network that should have been blocked.
This vulnerability exists because malformed, encoded traffic is not properly detected. An attacker could exploit this vulnerability by connecting through an affected device to a malicious server and receiving malformed HTTP responses. A successful exploit could allow the attacker to bypass an explicit block rule and receive traffic that should have been rejected by the device.
problem types: Improper Input Validation
affected:
{
vendor: Cisco
product: Cisco Secure Web Appliance
versions:
version: 11.8.0-414, status: affected
version: 11.8.1-023, status: affected
version: 11.8.3-018, status: affected
version: 11.8.3-021, status: affected
version: 12.0.1-268, status: affected
version: 12.0.3-007, status: affected
version: 12.5.2-007, status: affected
version: 12.5.1-011, status: affected
version: 12.5.4-005, status: affected
version: 12.5.5-004, status: affected
version: 14.5.0-498, status: affected
version: 14.0.3-014, status: affected
version: 14.0.2-012, status: affected
}
metrics:
format: cvssV3_1
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
baseScore: 5.3
baseSeverity: MEDIUM
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
]
exploits: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.