输出中的特殊元素转义处理不恰当（注入）

CVE编号

CVE-2023-20057

利用情况

暂无

补丁情况

N/A

披露时间

2023-01-20

漏洞描述

A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. This vulnerability is due to improper processing of URLs. An attacker could exploit this vulnerability by crafting a URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for an affected device, which could allow malicious URLs to pass through the device.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory...

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	系统	cisco	asyncos	-	-
	运行在以下环境
	硬件	cisco	email_security_appliance_c160	-	-
	运行在以下环境
	硬件	cisco	email_security_appliance_c170	-	-
	运行在以下环境
	硬件	cisco	email_security_appliance_c190	-	-
	运行在以下环境
	硬件	cisco	email_security_appliance_c370	-	-
	运行在以下环境
	硬件	cisco	email_security_appliance_c370d	-	-
	运行在以下环境
	硬件	cisco	email_security_appliance_c380	-	-
	运行在以下环境
	硬件	cisco	email_security_appliance_c390	-	-
	运行在以下环境
	硬件	cisco	email_security_appliance_c670	-	-
	运行在以下环境
	硬件	cisco	email_security_appliance_c680	-	-
	运行在以下环境
	硬件	cisco	email_security_appliance_c690	-	-
	运行在以下环境
	硬件	cisco	email_security_appliance_c690x	-	-
	运行在以下环境
	硬件	cisco	email_security_appliance_x1070	-	-

CVSS3评分 5.3

• 攻击路径 网络
• 攻击复杂度 低
• 权限要求 无
• 影响范围 未更改
• 用户交互 无
• 可用性 无
• 保密性 无
• 完整性 低

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-ID	漏洞类型
CWE-74	输出中的特殊元素转义处理不恰当（注入）

Exp相关链接

- avd.aliyun.com