CVE-2023-20215: cisco asyncos

Vulnerability summary

CVE-2023-20215 is a medium (CVSS 5.8) vulnerability in cisco asyncos. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 48.7% of scored vulnerabilities.

Timeline

1. 03-08-2023
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a configured rule, allowing traffic onto a network that should have been blocked. This vulnerability is due to improper detection of malicious traffic when the traffic is encoded with a specific content format. An attacker could exploit this vulnerability by using an affected device to connect to a malicious server and receiving crafted HTTP responses. A successful exploit could allow the attacker to bypass an explicit block rule and receive traffic that should have been rejected by the device.

• CWE-202Exposure of Sensitive Information Through Data QueriesWhen trying to keep information confidential, an attacker can often infer some of the information by using statistics.