Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2021-34698

Опубликовано: 06 окт. 2021
Источник: nvd
CVSS3: 8.6
CVSS3: 7.5
CVSS2: 7.8
EPSS Низкий

Описание

A vulnerability in the proxy service of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to exhaust system memory and cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper memory management in the proxy service of an affected device. An attacker could exploit this vulnerability by establishing a large number of HTTPS connections to the affected device. A successful exploit could allow the attacker to cause the system to stop processing new connections, which could result in a DoS condition. Note: Manual intervention may be required to recover from this situation.

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*
Версия от 12.0 (включая) до 12.0.3-005 (исключая)
cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*
Версия от 12.5 (включая) до 12.5.2-007 (исключая)
cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*
Версия от 14.0 (включая) до 14.0.1-014 (исключая)

Одно из

cpe:2.3:h:cisco:web_security_appliance_s170:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:web_security_appliance_s190:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:web_security_appliance_s380:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:web_security_appliance_s390:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:web_security_appliance_s680:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:web_security_appliance_s690:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:web_security_appliance_s690x:-:*:*:*:*:*:*:*

EPSS

Процентиль: 66%
0.00517
Низкий

8.6 High

CVSS3

7.5 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-401
CWE-401

Связанные уязвимости

github
больше 3 лет назад

A vulnerability in the proxy service of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to exhaust system memory and cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper memory management in the proxy service of an affected device. An attacker could exploit this vulnerability by establishing a large number of HTTPS connections to the affected device. A successful exploit could allow the attacker to cause the system to stop processing new connections, which could result in a DoS condition. Note: Manual intervention may be required to recover from this situation.

CVSS3: 8.6
fstec
больше 4 лет назад

Уязвимость прокси-сервера операционной системы Cisco AsyncOS интернет-шлюзов Cisco Web Security Appliance, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код

EPSS

Процентиль: 66%
0.00517
Низкий

8.6 High

CVSS3

7.5 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-401
CWE-401