VDB
CVE-2022-20784
CVE-2022-20784
PUBLISHED
CVSS 5.800000190734863 MEDIUM
A vulnerability in the Web-Based Reputation Score (WBRS) engine of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to bypass established web request policies and access blocked content on an affected device. This vulnerability is due to incorrect handling of certain character combinations inserted into a URL. An attacker could exploit this vulnerability by sending crafted URLs to be processed by an affected device. A successful exploit could allow the attacker to bypass the web proxy and access web content that has been blocked by policy.
EPSS 0.93% · 59.4th percentile
Risk Scores
CVSS 3.1
5.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
EPSS Score
0.93%
59.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| cisco | web_security_appliance | 11.7.0 |
| Cisco | Cisco Web Security Appliance (WSA) | * |
Timeline
- Apr 6, 2022 CVE Published
- Apr 9, 2022 EPSS Score
- May 30, 2022 EPSS Score
- Jul 21, 2022 EPSS Score
- Sep 10, 2022 EPSS Score
- Oct 31, 2022 EPSS Score
- Dec 21, 2022 EPSS Score
- Feb 10, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 2, 2023 EPSS Score
- May 23, 2023 EPSS Score
- Jul 13, 2023 EPSS Score