CVE-2022-20784
Cisco Web Security Appliance Filter Bypass Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in the Web-Based Reputation Score (WBRS) engine of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to bypass established web request policies and access blocked content on an affected device. This vulnerability is due to incorrect handling of certain character combinations inserted into a URL. An attacker could exploit this vulnerability by sending crafted URLs to be processed by an affected device. A successful exploit could allow the attacker to bypass the web proxy and access web content that has been blocked by policy.
Una vulnerabilidad en el motor Web-Based Reputation Score (WBRS) del software Cisco AsyncOS para Cisco Web Security Appliance (WSA) podría permitir a un atacante remoto no autenticado omitir las políticas de petición web establecidas y acceder a contenido bloqueado en un dispositivo afectado. Esta vulnerabilidad es debido al manejo incorrecto de determinadas combinaciones de caracteres insertadas en una URL. Un atacante podría explotar esta vulnerabilidad mediante el envío de URLs diseñadas para ser procesadas por un dispositivo afectado. Una explotación con éxito podría permitir al atacante omitir el proxy web y acceder al contenido web que ha sido bloqueado por la política
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2021-11-02 CVE Reserved
- 2022-04-06 CVE Published
- 2023-10-28 EPSS Updated
- 2024-11-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cisco Search vendor "Cisco" | Web Security Appliance Search vendor "Cisco" for product "Web Security Appliance" | >= 11.7.0 < 14.0.2 Search vendor "Cisco" for product "Web Security Appliance" and version " >= 11.7.0 < 14.0.2" | - |
Affected
| in | Cisco Search vendor "Cisco" | Web Security Appliance Search vendor "Cisco" for product "Web Security Appliance" | - | - |
Safe
|