CVE-2021-1223

MEDIUM Year: 2021
CVSS v3 Score
5.8
Medium
CVSS v2 Score
5.0
Medium
Weakness Type
CWE-693
View all →

Vulnerability Description

Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect handling of an HTTP range header. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload.

Related Vulnerabilities

CVE-2018-0243

MEDIUM
CVSS:5.8(Medium)

A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured file action policy that is intended to drop the Server...

CWE-6932018

CVE-2018-0244

MEDIUM
CVSS:5.8(Medium)

A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured file action policy to drop the Server Message Block (S...

CWE-6932018

CVE-2018-0297

MEDIUM
CVSS:5.8(Medium)

A vulnerability in the detection engine of Cisco Firepower Threat Defense software could allow an unauthenticated, remote attacker to bypass a configured Secure Sockets Layer (SSL) Access Control (AC)...

CWE-6932018

CVE-2018-0333

MEDIUM
CVSS:5.8(Medium)

A vulnerability in the VPN configuration management of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass VPN security due to unintended side effects of dynamic ...

CWE-6932018

CVE-2018-0384

MEDIUM
CVSS:5.8(Medium)

A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a URL-based access control policy that is configured to block traff...

CWE-6932018

CVE-2019-12696

MEDIUM
CVSS:5.8(Medium)

Multiple vulnerabilities in the Cisco Firepower System Software Detection Engine could allow an unauthenticated, remote attacker to bypass configured Malware and File Policies for RTF and RAR file typ...

CWE-6932019