CVE-2023-20215 (GCVE-0-2023-20215)
Vulnerability from cvelistv5 – Published: 2023-08-03 21:16 – Updated: 2024-08-02 09:05
VLAI
EPSS
VEX
Summary
A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a configured rule, allowing traffic onto a network that should have been blocked.
This vulnerability is due to improper detection of malicious traffic when the traffic is encoded with a specific content format. An attacker could exploit this vulnerability by using an affected device to connect to a malicious server and receiving crafted HTTP responses. A successful exploit could allow the attacker to bypass an explicit block rule and receive traffic that should have been rejected by the device.
Severity
5.8 (Medium)
CWE
- CWE-202 - Exposure of Sensitive Information Through Data Queries
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco Secure Web Appliance |
Affected:
11.7.0-406
Affected: 11.7.0-418 Affected: 11.7.1-049 Affected: 11.7.1-006 Affected: 11.7.1-020 Affected: 11.7.2-011 Affected: 11.8.0-414 Affected: 11.8.1-023 Affected: 11.8.3-018 Affected: 11.8.3-021 Affected: 12.0.1-268 Affected: 12.0.3-007 Affected: 12.5.2-007 Affected: 12.5.1-011 Affected: 12.5.4-005 Affected: 12.5.5-004 Affected: 14.5.0-498 Affected: 14.5.1-016 Affected: 14.0.3-014 Affected: 14.0.2-012 Affected: 14.0.4-005 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T09:05:35.594Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "cisco-sa-wsa-bypass-vXvqwzsj",
"tags": [
"x_transferred"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-bypass-vXvqwzsj"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Cisco Secure Web Appliance",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "11.7.0-406"
},
{
"status": "affected",
"version": "11.7.0-418"
},
{
"status": "affected",
"version": "11.7.1-049"
},
{
"status": "affected",
"version": "11.7.1-006"
},
{
"status": "affected",
"version": "11.7.1-020"
},
{
"status": "affected",
"version": "11.7.2-011"
},
{
"status": "affected",
"version": "11.8.0-414"
},
{
"status": "affected",
"version": "11.8.1-023"
},
{
"status": "affected",
"version": "11.8.3-018"
},
{
"status": "affected",
"version": "11.8.3-021"
},
{
"status": "affected",
"version": "12.0.1-268"
},
{
"status": "affected",
"version": "12.0.3-007"
},
{
"status": "affected",
"version": "12.5.2-007"
},
{
"status": "affected",
"version": "12.5.1-011"
},
{
"status": "affected",
"version": "12.5.4-005"
},
{
"status": "affected",
"version": "12.5.5-004"
},
{
"status": "affected",
"version": "14.5.0-498"
},
{
"status": "affected",
"version": "14.5.1-016"
},
{
"status": "affected",
"version": "14.0.3-014"
},
{
"status": "affected",
"version": "14.0.2-012"
},
{
"status": "affected",
"version": "14.0.4-005"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a configured rule, allowing traffic onto a network that should have been blocked.\r\n\r This vulnerability is due to improper detection of malicious traffic when the traffic is encoded with a specific content format. An attacker could exploit this vulnerability by using an affected device to connect to a malicious server and receiving crafted HTTP responses. A successful exploit could allow the attacker to bypass an explicit block rule and receive traffic that should have been rejected by the device."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-202",
"description": "Exposure of Sensitive Information Through Data Queries",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-25T16:58:20.215Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-wsa-bypass-vXvqwzsj",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-bypass-vXvqwzsj"
}
],
"source": {
"advisory": "cisco-sa-wsa-bypass-vXvqwzsj",
"defects": [
"CSCwf60901",
"CSCwf55917",
"CSCwf94501"
],
"discovery": "EXTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2023-20215",
"datePublished": "2023-08-03T21:16:38.159Z",
"dateReserved": "2022-10-27T18:47:50.368Z",
"dateUpdated": "2024-08-02T09:05:35.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2023-20215",
"date": "2026-10-05",
"epss": "0.00619",
"percentile": "0.47865"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "Cisco Secure Web Appliance",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "11.7.0-406"
},
{
"status": "affected",
"version": "11.7.0-418"
},
{
"status": "affected",
"version": "11.7.1-049"
},
{
"status": "affected",
"version": "11.7.1-006"
},
{
"status": "affected",
"version": "11.7.1-020"
},
{
"status": "affected",
"version": "11.7.2-011"
},
{
"status": "affected",
"version": "11.8.0-414"
},
{
"status": "affected",
"version": "11.8.1-023"
},
{
"status": "affected",
"version": "11.8.3-018"
},
{
"status": "affected",
"version": "11.8.3-021"
},
{
"status": "affected",
"version": "12.0.1-268"
},
{
"status": "affected",
"version": "12.0.3-007"
},
{
"status": "affected",
"version": "12.5.2-007"
},
{
"status": "affected",
"version": "12.5.1-011"
},
{
"status": "affected",
"version": "12.5.4-005"
},
{
"status": "affected",
"version": "12.5.5-004"
},
{
"status": "affected",
"version": "14.5.0-498"
},
{
"status": "affected",
"version": "14.5.1-016"
},
{
"status": "affected",
"version": "14.0.3-014"
},
{
"status": "affected",
"version": "14.0.2-012"
},
{
"status": "affected",
"version": "14.0.4-005"
}
]
}
],
"source": "psirt@cisco.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asyncos:11.7.0-406:*:*:*:*:*:*:*",
"matchCriteriaId": "A7A3D131-5E67-484E-93FA-BFF303019F38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:11.7.0-418:*:*:*:*:*:*:*",
"matchCriteriaId": "12FFA6C7-9B30-4D17-8AB6-523776611524",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:11.7.1-006:*:*:*:*:*:*:*",
"matchCriteriaId": "93F2A8D1-E9B1-4D01-B0EB-25B5E3A40B89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:11.7.1-020:*:*:*:*:*:*:*",
"matchCriteriaId": "0A13BA0C-9511-4522-BC82-702E0BE73C98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:11.7.1-049:*:*:*:*:*:*:*",
"matchCriteriaId": "2897D754-3B0B-4C18-8346-70CF2BE350A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:11.7.2-011:*:*:*:*:*:*:*",
"matchCriteriaId": "40D30CE8-84FA-4D81-9996-C07FD757B6C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:11.8.0-414:*:*:*:*:*:*:*",
"matchCriteriaId": "DDF27FDC-ADC4-4C98-8A49-DAD2471F8301",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:11.8.1-023:*:*:*:*:*:*:*",
"matchCriteriaId": "02072E0E-BC8C-4992-AB4D-BDE5829169A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:11.8.3-018:*:*:*:*:*:*:*",
"matchCriteriaId": "67213820-8CF2-4C0E-8BE8-801FD01A97C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:11.8.3-021:*:*:*:*:*:*:*",
"matchCriteriaId": "2281D49F-6C3F-4B09-AFB4-707253876591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:12.0.1-268:*:*:*:*:*:*:*",
"matchCriteriaId": "1F6D5632-1951-4DB7-9B56-4D1947E09ECD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:12.0.3-007:*:*:*:*:*:*:*",
"matchCriteriaId": "8F221598-29D1-4B13-A427-315F93BD9865",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:12.5.1-011:*:*:*:*:*:*:*",
"matchCriteriaId": "A2D22A3C-16D5-4F61-AB44-111F4A4D9F5C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:12.5.2-007:*:*:*:*:*:*:*",
"matchCriteriaId": "8C79D794-0BA9-4A55-B843-FBF9B7374095",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:12.5.4-005:*:*:*:*:*:*:*",
"matchCriteriaId": "BBE6E431-7859-4E92-88C5-C85DADC8A5D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:12.5.5-004:*:*:*:*:*:*:*",
"matchCriteriaId": "495A2286-32A3-4F86-9D14-A1561FCE418A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:14.0.2-012:*:*:*:*:*:*:*",
"matchCriteriaId": "50BAC418-1CA1-4DB7-8B54-E4754A35F6E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:14.0.3-014:*:*:*:*:*:*:*",
"matchCriteriaId": "A3A1AE33-A44E-422C-BBF3-FEF0BD24081D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:14.0.4-005:*:*:*:*:*:*:*",
"matchCriteriaId": "D5A91305-1002-4717-AB81-A98C9C30CEA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:14.5.0-498:*:*:*:*:*:*:*",
"matchCriteriaId": "60A56580-C34C-4E5D-B053-9D02F8DD9681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:14.5.1-008:*:*:*:*:*:*:*",
"matchCriteriaId": "89DC9472-A8C0-41CB-99DE-B0E160157B3C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:14.5.1-016:*:*:*:*:*:*:*",
"matchCriteriaId": "78109D4E-9FAA-4B5A-96E4-6D30D3458BFD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:s195:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9797CD28-48A3-45BD-BF68-F0DF6F5A5579",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:s395:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D20279-8176-449A-AF4C-E2C90F370B30",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:s695:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D9408ADA-7A8F-4528-8236-65713CF642D5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:web_security_appliance_s170:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E401F29A-026F-4097-B513-47911CB3AA09",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:web_security_appliance_s190:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AA3B097B-F689-4886-A0C6-B71ECAD783CF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:web_security_appliance_s380:-:*:*:*:*:*:*:*",
"matchCriteriaId": "23C3AECC-9270-42B5-A36E-208AA0B48D93",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:web_security_appliance_s390:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5290B9CF-CF7D-4762-B5EE-5DAEA03C6409",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:web_security_appliance_s680:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BE85462C-079B-4488-AB0E-989D41EB7AFD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:web_security_appliance_s690:-:*:*:*:*:*:*:*",
"matchCriteriaId": "48A8E5E8-8361-4BC8-BFA9-CAE4745A9C48",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:web_security_appliance_s690x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FBEAFE16-BD4F-4538-9A06-173FB678DB8B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a configured rule, allowing traffic onto a network that should have been blocked.\r\n\r This vulnerability is due to improper detection of malicious traffic when the traffic is encoded with a specific content format. An attacker could exploit this vulnerability by using an affected device to connect to a malicious server and receiving crafted HTTP responses. A successful exploit could allow the attacker to bypass an explicit block rule and receive traffic that should have been rejected by the device."
}
],
"id": "CVE-2023-20215",
"lastModified": "2026-06-17T05:29:55.020",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "psirt@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-08-03T22:15:11.513",
"references": [
{
"source": "psirt@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-bypass-vXvqwzsj"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-bypass-vXvqwzsj"
}
],
"sourceIdentifier": "psirt@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-202"
}
],
"source": "psirt@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…