Vulnerabilities > CVE-2020-3117 - Unspecified vulnerability in Cisco products

CVSS 4.7 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

LOW

Availability impact

NONE

network

low complexity

cisco

nessus

NVD

Published: 2020-09-23

Updated: 2020-10-01

Summary

A vulnerability in the API Framework of Cisco AsyncOS for Cisco Web Security Appliance (WSA) and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to inject crafted HTTP headers in the web server's response. The vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user to access a crafted URL and receive a malicious HTTP response. A successful exploit could allow the attacker to inject arbitrary HTTP headers into valid HTTP responses sent to a user's browser.

Vulnerable Configurations

Part	Description	Count
Application	Cisco Cisco WEB Security Appliance 11.8.0-382 Cisco WEB Security Appliance 12.0.1-268 Cisco Content Security Management Appliance - Cisco Content Security Management Appliance 8.3.6-039 Cisco Content Security Management Appliance 9.1.0 Cisco Content Security Management Appliance 9.1.0-031 Cisco Content Security Management Appliance 9.1.0-31 Cisco Content Security Management Appliance 9.1.0-033 Cisco Content Security Management Appliance 9.1.0-103 Cisco Content Security Management Appliance 9.5.0 Cisco Content Security Management Appliance 9.6.0 Cisco Content Security Management Appliance 9.6.6-068 Cisco Content Security Management Appliance 9.7.0-006 Cisco Content Security Management Appliance 10.0.0-203 Cisco Content Security Management Appliance 10.1.0-037 Cisco Content Security Management Appliance 10.1.0-049 Cisco Content Security Management Appliance 11.4.0-812 Cisco Content Security Management Appliance 12.0 Cisco Content Security Management Appliance 12.0.1 Cisco Content Security Management Appliance 12.5.0 Cisco Content Security Management Appliance 12.5.0-436 Cisco Content Security Management Appliance 12.8.1-002	22

Nessus

NASL family	CISCO
NASL id	CISCO-SA-20200122-SMA-HEADER-INJECT.NASL
description	According to its self-reported version, the Cisco Content Security Management Appliance (SMA) is affected by a HTTP Header Injection vulnerability. Please see the included Cisco BIDs and the Cisco Security Advisory for more information.
last seen	2020-06-01
modified	2020-06-02
plugin id	133405
published	2020-01-31
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/133405
title	Cisco Content Security Management Appliance HTTP Header Injection Vulnerability

NASL family	CISCO
NASL id	CISCO-SA-20200122-WSA-SMA-HEADER-INJECT.NASL
description	According to its self-reported version, Cisco Web Security Appliance (WSA) is affected by a HTTP Header Injection vulnerability. Please see the included Cisco BIDs and the Cisco Security Advisory for more information.
last seen	2020-06-01
modified	2020-06-02
plugin id	133406
published	2020-01-31
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/133406
title	Cisco Web Security Appliance HTTP Header Injection Vulnerability

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-wsa-sma-header-inject