CVE-2022-20784 (CNNVD-202204-2469)
中文标题:
Cisco Web Security Appliance 输入验证错误漏洞
英文标题:
Cisco Web Security Appliance Filter Bypass Vulnerability
漏洞描述
中文描述:
Cisco Web Security Appliance（WSA）是美国思科（Cisco）公司的一款Web安全设备。该设备提供基于SaaS的访问控制、实时网络报告和追踪、制定安全策略等功能。 Cisco Web Security Appliance (WSA) 存在输入验证错误漏洞，该漏洞源于对插入 URL 的某些字符组合的错误处理。攻击者利用此漏洞可绕过 Web 代理并访问已被策略阻止的 Web 内容。
英文描述:
A vulnerability in the Web-Based Reputation Score (WBRS) engine of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to bypass established web request policies and access blocked content on an affected device. This vulnerability is due to incorrect handling of certain character combinations inserted into a URL. An attacker could exploit this vulnerability by sending crafted URLs to be processed by an affected device. A successful exploit could allow the attacker to bypass the web proxy and access web content that has been blocked by policy.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Cisco | Cisco Web Security Appliance (WSA) | n/a | - | - |
cpe:2.3:a:cisco:cisco_web_security_appliance_(wsa):n_a:*:*:*:*:*:*:*
|
| cisco | web_security_appliance | * | - | - |
cpe:2.3:a:cisco:web_security_appliance:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
3.1 (cna)
MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2022-20784 |
2025-11-11 15:21:15 | 2025-11-11 07:37:15 |
| NVD | nvd_CVE-2022-20784 |
2025-11-11 14:58:16 | 2025-11-11 07:45:32 |
| CNNVD | cnnvd_CNNVD-202204-2469 |
2025-11-11 15:10:51 | 2025-11-11 07:57:13 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 输入验证错误
- cnnvd_id: 未提取 -> CNNVD-202204-2469
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']