CVE-2023-20246CWE-290

CVE-2023-20246

Medium · published November 1, 2023

CVSS v3.1
5.8
EPSS
1%
Percentile
46.1
In the wild
Unconfirmed
What it is

Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system.

This vulnerability is due to a logic error that occurs when the access control policies are being populated. An attacker could exploit this vulnerability by establishing a connection to an affected device. A successful exploit could allow the attacker to bypass configured access control rules on the affected system.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00564 · 46.1th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2023-11-01T22:15Z
Affected products (3)
ProductVersionsFixed in
snort/snort≥ 3.0.0, < 3.1.57.03.1.57.0
cisco/secure_firewall_threat_defense≥ 7.0.0, ≤ 7.3.1.1—
cisco/ios_xe≥ 17.12, < 17.12.217.12.2
References (2)
EPSS history
Timeline
  • 01 NOV 17:13Z
    Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenticated, remote attacker to bypass the…
    cvelistv5