CVE-2017-6751

HIGH

Cisco Web Security Appliance - Unauthenticated Access Control Bypass via Web Proxy Interface

Title source: llm
STIX 2.1

Description

A vulnerability in the web proxy functionality of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to forward traffic from the web proxy interface of an affected device to the administrative management interface of an affected device, aka an Access Control Bypass Vulnerability. Affected Products: virtual and hardware versions of Cisco Web Security Appliance (WSA). More Information: CSCvd88863. Known Affected Releases: 10.1.0-204 9.0.0-485.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/99967
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1038959

Scores

CVSS v3 7.5
EPSS 0.0196
EPSS Percentile 78.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-20
Status published
Products (11)
cisco/web_security_appliance 9.0.0-162
cisco/web_security_appliance 9.0.0-193
cisco/web_security_appliance 9.0.0-485
cisco/web_security_appliance 10.0.0-232
cisco/web_security_appliance 10.0.0-233
cisco/web_security_appliance 10.1.0-204
cisco/web_security_virtual_appliance 9.0.0
cisco/web_security_virtual_appliance 10.0.0
cisco/web_security_virtual_appliance 10.1.0
cisco/web_security_virtual_appliance 10.1.1
... and 1 more
Published Jul 25, 2017
Tracked Since Feb 18, 2026