« Volver al listado

CVE-2017-6751

Estado: ModificadaAlta (7.5)—

A vulnerability in the web proxy functionality of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to forward traffic from the web proxy interface of an affected device to the administrative management interface of an affected device, aka an Access Control Bypass Vulnerability. Affected Products: virtual and hardware versions of Cisco Web Security Appliance (WSA). More Information: CSCvd88863. Known Affected Releases: 10.1.0-204 9.0.0-485.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Cisco — WEB Security ApplianceCisco — WEB Security Virtual Appliance

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-6751",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Cisco Web Security Appliance",
          "versions": [
            {
              "status": "affected",
              "version": "Cisco Web Security Appliance"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-07-25T19:29:00.363",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/99967",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1038959",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170719-wsa5",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/99967",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1038959",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170719-wsa5",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the web proxy functionality of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to forward traffic from the web proxy interface of an affected device to the administrative management interface of an affected device, aka an Access Control Bypass Vulnerability. Affected Products: virtual and hardware versions of Cisco Web Security Appliance (WSA). More Information: CSCvd88863. Known Affected Releases: 10.1.0-204 9.0.0-485."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la funcionalidad proxy web de Cisco Web Security Appearance (WSA) podría permitir que un atacante remoto no autenticado redirija tráfico de la interfaz proxy web de un dispositivo afectado a una interfaz de administración de un dispositivo afectado. Esta vulnerabilidad también se conoce como \"Access Control Bypass Vulnerability\". Productos afectados: versiones de hardware y virtuales de Cisco Web Security Appliance (WSA). Más información: CSCvd88863. Versiones afectadas conocidas: 10.1.0-204 9.0.0-485."
    }
  ],
  "lastModified": "2026-06-17T01:22:58.130",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:web_security_appliance:9.0.0-162:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5BF001A-7ADB-4976-8A50-0EFC53FB6AEC"
            },
            {
              "criteria": "cpe:2.3:a:cisco:web_security_appliance:9.0.0-193:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5AD5471D-6A95-4BF2-9ECB-3F7AE74BCE57"
            },
            {
              "criteria": "cpe:2.3:a:cisco:web_security_appliance:9.0.0-485:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72CE42EB-F7F1-4F68-BFCF-B452A2C0AC13"
            },
            {
              "criteria": "cpe:2.3:a:cisco:web_security_appliance:10.0.0-232:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F4BDE8C-6D41-4BCF-8BB3-9256E2AD09E8"
            },
            {
              "criteria": "cpe:2.3:a:cisco:web_security_appliance:10.0.0-233:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C84C8F0-4722-4385-B3CD-86E05F3D72BA"
            },
            {
              "criteria": "cpe:2.3:a:cisco:web_security_appliance:10.1.0-204:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC71F9F5-B0BA-4415-A4C8-9D0B15732A54"
            },
            {
              "criteria": "cpe:2.3:a:cisco:web_security_virtual_appliance:9.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0CAE1AB3-224F-473D-8E41-DF641CFBF864"
            },
            {
              "criteria": "cpe:2.3:a:cisco:web_security_virtual_appliance:10.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69528D17-2EA4-4CF5-B2D4-26B185C66ED8"
            },
            {
              "criteria": "cpe:2.3:a:cisco:web_security_virtual_appliance:10.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BED59A8D-41E6-448E-AEEF-91400742CC0B"
            },
            {
              "criteria": "cpe:2.3:a:cisco:web_security_virtual_appliance:10.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EFF6B908-B1A0-48FC-A481-CA2AF9738BE0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}