CVE-2017-3814
published 2017-02-03CVE-2017-3814: A vulnerability in Cisco Firepower System Software could allow an unauthenticated, remote attacker to maliciously bypass the appliance's ability to block…
PriorityP432medium5.8CVSS 3.0
AVNACLPRNUINSCCLINAN
EPSS
1.85%
76.8th percentile
A vulnerability in Cisco Firepower System Software could allow an unauthenticated, remote attacker to maliciously bypass the appliance's ability to block certain web content, aka a URL Bypass. More Information: CSCvb93980. Known Affected Releases: 5.3.0 5.4.0 6.0.0 6.0.1 6.1.0.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | firepower_url | — | — |
| cisco | secure_firewall_management_center | — | — |
| cisco | secure_firewall_management_center | — | — |
| cisco | secure_firewall_management_center | — | — |
| cisco | secure_firewall_management_center | — | — |
| cisco | secure_firewall_management_center | — | — |
CVSS provenance
nvdv3.05.8MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
vendor_cisco5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Firepower URL Bypass Vulnerability
vendor_cisco·2017-02-01·CVSS 5.8
CVE-2017-3814 [MEDIUM] CWE-20 Cisco Firepower URL Bypass Vulnerability
Cisco Firepower URL Bypass Vulnerability
A vulnerability in Cisco Firepower System Software could allow an unauthenticated, remote attacker to maliciously bypass the appliance's ability to block certain web content.
The vulnerability is due to insufficient input validation checks within the system's access control rule criteria. An attacker could exploit this vulnerability by adding malicious text to the end of a URL string. An exploit could allow the attacker to bypass configured blocked websites.
There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170201-fpw1
Cisco
Cisco Firepower URL Bypass Vulnerability
vendor_cisco·CVSS 3.0
CVE-2017-3814 Cisco Firepower URL Bypass Vulnerability
CVE-2017-3814: Cisco Firepower URL Bypass Vulnerability
A vulnerability in Cisco Firepower System Software could allow an unauthenticated, remote attacker to maliciously bypass the appliance's ability to block certain web content. The vulnerability is due to insufficient input validation checks within the system's access control rule criteria. An attacker could exploit this vulnerability by adding malicious text to the end of a URL string. An exploit could allow the attacker to bypass configured blocked websites. There are no
CVSS: 3.0
CWE: CWE-20, CWE-20
Bug IDs: CSCvb93980
GHSA
GHSA-6jr8-8wm2-r335: A vulnerability in Cisco Firepower System Software could allow an unauthenticated, remote attacker to maliciously bypass the appliance's ability to bl
ghsa_unreviewed·2022-05-17
CVE-2017-3814 [MEDIUM] CWE-20 GHSA-6jr8-8wm2-r335: A vulnerability in Cisco Firepower System Software could allow an unauthenticated, remote attacker to maliciously bypass the appliance's ability to bl
A vulnerability in Cisco Firepower System Software could allow an unauthenticated, remote attacker to maliciously bypass the appliance's ability to block certain web content, aka a URL Bypass. More Information: CSCvb93980. Known Affected Releases: 5.3.0 5.4.0 6.0.0 6.0.1 6.1.0.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2017-02-03
Published