CVE-2017-6751 Auth bypass in Cisco Web Security Appliance

High 7.5 Published 25 Jul 2017 Updated 5 Aug 2024

Unauthenticated remote attackers can bypass access controls to forward traffic to the administrative management interface of Cisco WSA devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-6751?

CVE-2017-6751 is a high-severity authentication bypass vulnerability in Cisco Web Security Appliance, published on 25 Jul 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the web proxy functionality of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to forward traffic from the web proxy interface of an affected device to the administrative management interface of an affected device, aka an Access Control Bypass Vulnerability. Affected Products: virtual and hardware versions of Cisco Web Security Appliance (WSA). More Information: CSCvd88863. Known Affected Releases: 10.1.0-204 9.0.0-485.

Weakness: CWE-20

Which versions are affected by CVE-2017-6751?

It affects 2 products.

Products include Cisco Web Security Appliance, Cisco Web Security Virtual Appliance.

How do I fix CVE-2017-6751?

No fix has been published for CVE-2017-6751 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2017-6751 being exploited?

There is no known exploitation of CVE-2017-6751 in the wild and no public exploit code.

All Cisco Web Security Appliance vulnerabilities

Sources

Also known as GHSA-78hh-rj37-p22v.