CVE-2024-20363

CWE-2906 documents5 sources

Severity

5.8MEDIUM

EPSS

0.1%

top 65.43%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Snort Cisco Cisco Firepower Threat Defense Software Cisco Cisco UTD Snort IPS Engine Software +2 more

Timeline

PublishedMay 22

Description

Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that could allow an unauthenticated, remote attacker to bypass the configured rules on an affected system. This vulnerability is due to incorrect HTTP packet handling. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass configured IPS rules and allow uninspected traffic onto …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages5 packages

▶NVDcisco/unified_threat_defense_snort_intrusion_prevention_system_engine4 versions+3

▶CVEListV5cisco/cisco_utd_snort_ips_engine_software4 versions+3

▶NVDcisco/snort3.0.0-233 — 3.1.69.0

▶NVDcisco/firepower_threat_defense7.4.0

▶CVEListV5cisco/cisco_firepower_threat_defense_software7.4.0

🔴Vulnerability Details

GHSA

GHSA-fgmg-8v8r-jj8g: Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that could allow an unauthenticated↗2024-05-22

▶

CVEList

CVE-2024-20363: Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that could allow an unauthenticated↗2024-05-22

▶

📋Vendor Advisories

Cisco

Multiple Cisco Products Snort 3 HTTP Intrusion Prevention System Rule Bypass Vulnerability↗2024-05-22

▶