CVE-2023-20215

CVSS 3.1 Score 5.8 of 10 (medium)

Details

Published Aug 3, 2023
Updated: Jan 25, 2024
CWE ID 202

Summary

CVE-2023-20215 is a vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance. It allows an unauthenticated, remote attacker to bypass a configured rule and allow traffic onto a network that should have been blocked. The vulnerability occurs due to improper detection of malicious traffic when it is encoded with a specific content format. An attacker can exploit this vulnerability by connecting to a malicious server using an affected device and receiving crafted HTTP responses. This would enable the attacker to bypass block rules and receive traffic that should have been rejected by the device. The vulnerability has a risk score of 25 and a base severity rating of MEDIUM. It affects various products and can pose a potential danger to organizations by compromising network security if not remediated promptly.

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-20215 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options