CVE Vulnerability

CVE-2019-1876

A vulnerability in the HTTPS proxy feature of Cisco Wide Area Application Services (WAAS) Software could allow an unauthenticated, remote attacker to use the Central Manager as an HTTPS proxy. The vulnerability is due to insufficient authentication of proxy connection requests. An attacker could exploit this vulnerability by sending a malicious HTTPS CONNECT message to the Central Manager. A successful exploit could allow the attacker to access public internet resources that would normally be blocked by corporate policies.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

5.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-waas-authbypass Vendor Advisory
http://www.securityfocus.com/bid/108863 Third Party Advisory VDB Entry
Configurations

Configuration 1

cpe:2.3:a:cisco:wide_area_application_services:5.5(7):*:*:*:*:*:*:*
cpe:2.3:a:cisco:wide_area_application_services:6.1(1):*:*:*:*:*:*:*
cpe:2.3:a:cisco:wide_area_application_services:6.4(3b):*:*:*:*:*:*:*
Information

Published : 2019-06-20 03:15

Updated : 2019-10-09 11:48

NVD link : CVE-2019-1876

Mitre link : CVE-2019-1876

Products Affected
No products.
CWE
CWE-306