CVE-2019-1884: Cisco Web Security Appliance Web Proxy Denial of Service Vulnerability
First published: Thu Jul 04 2019(Updated: )
A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation mechanisms for certain fields in HTTP/HTTPS requests sent through an affected device. A successful attacker could exploit this vulnerability by sending a malicious HTTP/HTTPS request through an affected device. An exploit could allow the attacker to force the device to stop processing traffic, resulting in a DoS condition.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco AsyncOS | >=10.1<10.5.5-005 | |
| Cisco AsyncOS | >=11.5<11.5.2-020 | |
| Cisco AsyncOS | >=11.7<11.7.0-407 | |
| Cisco Web Security Appliance | =10.1.4-017 | |
| Cisco Web Security Appliance | =10.5.2-072 | |
| Cisco Web Security Appliance | =11.5.1-fcs-125 | |
| Cisco Web Security Appliance | =11.7.0-256 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-1884?
CVE-2019-1884 is a vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) that could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
How does CVE-2019-1884 impact Cisco AsyncOS Software?
CVE-2019-1884 could cause a denial of service (DoS) condition on an affected device running Cisco AsyncOS Software for Cisco Web Security Appliance.
Which versions of Cisco AsyncOS Software are affected by CVE-2019-1884?
Versions of Cisco AsyncOS Software for Cisco Web Security Appliance between 10.1 and 11.7 are affected by CVE-2019-1884.
What is the severity of CVE-2019-1884?
CVE-2019-1884 has a severity rating of high with a score of 6.5 out of 10.
How can I fix CVE-2019-1884?
To mitigate CVE-2019-1884, Cisco recommends upgrading to a fixed software release based on the information provided in the Cisco Security Advisory.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/title
- agent/references
- agent/author
- agent/last-modified-date
- agent/event
- agent/description
- agent/first-publish-date
- agent/tags
- vendor/cisco
- canonical/cisco asyncos
- version/cisco asyncos/10.1
- version/cisco asyncos/11.5
- version/cisco asyncos/11.7
- canonical/cisco web security appliance
- version/cisco web security appliance/10.1.4-017
- version/cisco web security appliance/10.5.2-072
- version/cisco web security appliance/11.5.1-fcs-125
- version/cisco web security appliance/11.7.0-256