Lucene search

K
cve[email protected]CVE-2022-20737
HistoryMay 03, 2022 - 4:15 a.m.

CVE-2022-20737

2022-05-0304:15:09
CWE-787
CWE-122
web.nvd.nist.gov
105
6
cve-2022-20737
cisco
asa
http authentication
security vulnerability
dos
information disclosure

8.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H

7.1 High

AI Score

Confidence

High

7 High

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:P/I:N/A:C

0.001 Low

EPSS

Percentile

44.2%

A vulnerability in the handler for HTTP authentication for resources accessed through the Clientless SSL VPN portal of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device or to obtain portions of process memory from an affected device. This vulnerability is due to insufficient bounds checking when parsing specific HTTP authentication messages. An attacker could exploit this vulnerability by sending malicious traffic to an affected device acting as a VPN Gateway. To send this malicious traffic, an attacker would need to control a web server that can be accessed through the Clientless SSL VPN portal. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition, or to retrieve bytes from the device process memory that may contain sensitive information.

Affected configurations

NVD
Node
ciscoadaptive_security_appliance_softwareRange<9.12.4.38
OR
ciscoadaptive_security_appliance_softwareRange9.13.09.14.4
OR
ciscoadaptive_security_appliance_softwareRange9.15.09.15.1.21
OR
ciscoadaptive_security_appliance_softwareRange9.16.09.16.2.14
OR
ciscoadaptive_security_appliance_softwareRange9.17.09.17.1.7

CNA Affected

[
  {
    "product": "Cisco Adaptive Security Appliance (ASA) Software ",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

Social References

More

8.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H

7.1 High

AI Score

Confidence

High

7 High

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:P/I:N/A:C

0.001 Low

EPSS

Percentile

44.2%

Related for CVE-2022-20737