How severe is CVE-2023-20275?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 4.3 out of 10.

What type of vulnerability is CVE-2023-20275?

This is classified as CWE-346, which is a common weakness in software security.

CVE-2023-20275 - MEDIUM Severity | CVSS 4.3

Vulnerability Description

A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to send packets with another VPN user's source IP address. This vulnerability is due to improper validation of the packet's inner source IP address after decryption. An attacker could exploit this vulnerability by sending crafted packets through the tunnel. A successful exploit could allow the attacker to send a packet impersonating another VPN user's IP address. It is not possible for the attacker to receive return packets.

Related Vulnerabilities

CVE-2017-8523

MEDIUM

CVSS:4.3(Medium)

Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page with malicious content when Microsoft Edge fails to co...

CWE-3462017

CVE-2018-8112

MEDIUM

CVSS:4.3(Medium)

A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka "Microsoft Edge Security Feature Bypass Vulnerability." This affects Microsoft ...

CWE-3462018

CVE-2018-8235

MEDIUM

CVSS:4.3(Medium)

CWE-3462018

CVE-2019-1413

MEDIUM

CVSS:4.3(Medium)

A security feature bypass vulnerability exists when Microsoft Edge improperly handles extension requests and fails to request host permission for all_urls, aka 'Microsoft Edge Security Feature Bypass ...

CWE-3462019

CVE-2020-12397

MEDIUM

CVSS:4.3(Medium)

By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerability affects Thunderbird < 68.8.0.

CWE-3462020

CVE-2020-28481

MEDIUM

CVSS:4.3(Medium)

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

CWE-3462020