CVE-2021-1223
Assigner: cisco
Published: 2021-01-13T00:00:00
State: PUBLISHED
title: Multiple Cisco Products Snort HTTP Detection Engine File Policy Bypass Vulnerability
datePublic: 2021-01-13T00:00:00
descriptions: value: Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect handling of an HTTP range header. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload.
affected: vendor: Cisco
product: Cisco Firepower Threat Defense Software 
versions: version: n/a
status: affected
metrics: cvssV3_0: version: 3.0
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
problemTypes: descriptions: type: CWE
description: CWE-693
cweId: CWE-693
source: advisory: cisco-sa-snort-filepolbypass-67DEwMe2
defect: CSCvs71969
CSCvu18635
discovery: INTERNAL
exploits: value: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.