CVE-2016-1296 — Cisco WEB Security Appliance vulnerability

CWE-254 CWE-2644 documents4 sources

Severity

7.5HIGHNVD

EPSS

0.4%

top 41.17%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco WEB Security Appliance

Timeline

PublishedJan 20

Latest updateMay 17

Description

The proxy engine on Cisco Web Security Appliance (WSA) devices with software 8.5.3-055, 9.1.0-000, and 9.5.0-235 allows remote attackers to bypass intended proxy restrictions via a malformed HTTP method, aka Bug ID CSCux00848.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDcisco/web_security_appliance8.5.3-055, 9.1.0-000, 9.5.0-235+2

🔴Vulnerability Details

GHSA

GHSA-6jg2-9jcr-443r: The proxy engine on Cisco Web Security Appliance (WSA) devices with software 8↗2022-05-17

▶

CVEList

CVE-2016-1296: The proxy engine on Cisco Web Security Appliance (WSA) devices with software 8↗2016-01-20

▶

📋Vendor Advisories

Cisco

Cisco Web Security Appliance Security Bypass Vulnerability↗2016-01-19

▶