7.4
High
CVE-2021-1566 A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco…
Description
A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to intercept traffic between an affected device and the AMP servers. This vulnerability is due to improper certificate validation when an affected device establishes TLS connections. A man-in-the-middle attacker could exploit this vulnerability by sending a crafted TLS packet to an affected device. A successful exploit could allow the attacker to spoof a trusted host and then extract sensitive information or alter certain API requests.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cisco Web Security Appliance (WSA) | Versions not published |
Other CVEs of Cisco Web Security Appliance (WSA)
The 24 CVEs of Cisco Web Security Appliance (WSA) →
CVE-2023-20120
Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and…
5.4
Medium
CVE-2023-20028
Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and…
5.4
Medium
CVE-2022-20675
A vulnerability in the TCP/IP stack of Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and…
5.3
Medium
CVE-2022-20781
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA)…
5.4
Medium