CVE-2022-20713

State: Published
Severity: 4.3 Medium
Published: Aug 10, 2022
Updated: Sep 16, 2024
Reserved: Nov 2, 2021

Description

A vulnerability in the VPN web client services component of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct browser-based attacks against users of an affected device. This vulnerability is due to improper validation of input that is passed to the VPN web client services component before being returned to the browser that is in use. An attacker could exploit this vulnerability by persuading a user to visit a website that is designed to pass malicious requests to a device that is running Cisco ASA Software or Cisco FTD Software and has web services endpoints supporting VPN features enabled. A successful exploit could allow the attacker to reflect malicious input from the affected device to the browser that is in use and conduct browser-based attacks, including cross-site scripting attacks. The attacker could not directly impact the affected device.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	cisco

Weaknesses

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Affected Products

Product	Versions
Cisco Adaptive Security Appliance (ASA) SoftwareCisco	9.8.1Affected 9.8.1.5Affected 9.8.1.7Affected 9.8.2Affected 9.8.2.8Affected 9.8.2.14Affected 9.8.2.15Affected 9.8.2.17Affected 9.8.2.20Affected 9.8.2.24Affected 9.8.2.26Affected 9.8.2.28Affected 9.8.2.33Affected 9.8.2.35Affected 9.8.2.38Affected 9.8.3.8Affected 9.8.3.11Affected 9.8.3.14Affected 9.8.3.16Affected 9.8.3.18Affected 9.8.3.21Affected 9.8.3Affected 9.8.3.26Affected 9.8.3.29Affected 9.8.4Affected and 141 more versions
Cisco Firepower Threat Defense SoftwareCisco	6.2.3Affected 6.2.3.1Affected 6.2.3.2Affected 6.2.3.3Affected 6.2.3.4Affected 6.2.3.5Affected 6.2.3.6Affected 6.2.3.7Affected 6.2.3.8Affected 6.2.3.10Affected 6.2.3.11Affected 6.2.3.9Affected 6.2.3.12Affected 6.2.3.13Affected 6.2.3.14Affected 6.2.3.15Affected 6.2.3.16Affected 6.2.3.17Affected 6.2.3.18Affected 6.6.0Affected 6.6.0.1Affected 6.6.1Affected 6.6.3Affected 6.6.4Affected 6.6.5Affected and 47 more versions

Product

Versions

Cisco Adaptive Security Appliance (ASA) SoftwareCisco

9.8.1Affected
9.8.1.5Affected
9.8.1.7Affected
9.8.2Affected
9.8.2.8Affected
9.8.2.14Affected
9.8.2.15Affected
9.8.2.17Affected
9.8.2.20Affected
9.8.2.24Affected
9.8.2.26Affected
9.8.2.28Affected
9.8.2.33Affected
9.8.2.35Affected
9.8.2.38Affected
9.8.3.8Affected
9.8.3.11Affected
9.8.3.14Affected
9.8.3.16Affected
9.8.3.18Affected
9.8.3.21Affected
9.8.3Affected
9.8.3.26Affected
9.8.3.29Affected
9.8.4Affected
and 141 more versions

Cisco Firepower Threat Defense SoftwareCisco

6.2.3Affected
6.2.3.1Affected
6.2.3.2Affected
6.2.3.3Affected
6.2.3.4Affected
6.2.3.5Affected
6.2.3.6Affected
6.2.3.7Affected
6.2.3.8Affected
6.2.3.10Affected
6.2.3.11Affected
6.2.3.9Affected
6.2.3.12Affected
6.2.3.13Affected
6.2.3.14Affected
6.2.3.15Affected
6.2.3.16Affected
6.2.3.17Affected
6.2.3.18Affected
6.6.0Affected
6.6.0.1Affected
6.6.1Affected
6.6.3Affected
6.6.4Affected
6.6.5Affected
and 47 more versions

References

cisco-sa-asa-webvpn-LOeKsNmO

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.