Lucene search

[email protected]CVE-2017-6751

HistoryJul 25, 2017 - 7:29 p.m.

CVE-2017-6751

2017-07-2519:29:00

CWE-20

[email protected]

web.nvd.nist.gov

cisco

wsa

vulnerability

web proxy

cisco web security appliance

access control bypass

nvd

cve-2017-6751

cscvd88863

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

6.9 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

52.5%

JSON

A vulnerability in the web proxy functionality of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to forward traffic from the web proxy interface of an affected device to the administrative management interface of an affected device, aka an Access Control Bypass Vulnerability. Affected Products: virtual and hardware versions of Cisco Web Security Appliance (WSA). More Information: CSCvd88863. Known Affected Releases: 10.1.0-204 9.0.0-485.

CPENameOperatorVersion
cisco:web_security_appliancecisco web security applianceeq10.1.0-204
cisco:web_security_appliancecisco web security applianceeq10.0.0-232
cisco:web_security_appliancecisco web security applianceeq9.0.0-162
cisco:web_security_virtual_appliancecisco web security virtual applianceeq10.1.0
cisco:web_security_virtual_appliancecisco web security virtual applianceeq9.0.0
cisco:web_security_appliancecisco web security applianceeq9.0.0-193
cisco:web_security_virtual_appliancecisco web security virtual applianceeq10.0.0
cisco:web_security_appliancecisco web security applianceeq10.0.0-233
cisco:web_security_virtual_appliancecisco web security virtual applianceeq10.1.1
cisco:web_security_appliancecisco web security applianceeq9.0.0-485

CPE	Name	Operator	Version
cisco:web_security_appliance	cisco web security appliance	eq	10.1.0-204
cisco:web_security_appliance	cisco web security appliance	eq	10.0.0-232
cisco:web_security_appliance	cisco web security appliance	eq	9.0.0-162
cisco:web_security_virtual_appliance	cisco web security virtual appliance	eq	10.1.0
cisco:web_security_virtual_appliance	cisco web security virtual appliance	eq	9.0.0
cisco:web_security_appliance	cisco web security appliance	eq	9.0.0-193
cisco:web_security_virtual_appliance	cisco web security virtual appliance	eq	10.0.0
cisco:web_security_appliance	cisco web security appliance	eq	10.0.0-233
cisco:web_security_virtual_appliance	cisco web security virtual appliance	eq	10.1.1
cisco:web_security_appliance	cisco web security appliance	eq	9.0.0-485

References

www.securityfocus.com/bid/99967

www.securitytracker.com/id/1038959

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170719-wsa5

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

6.9 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

52.5%

JSON

Related for CVE-2017-6751

openvas1 prion1 cvelist1 cisco1 nessus1