CVE-2022-20781: Cisco Web Security Appliance Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by inserting malicious data into a specific data field in an affected interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-20781?
CVE-2022-20781 is a vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) that could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected device.
What is the severity of CVE-2022-20781?
The severity of CVE-2022-20781 is medium, with a CVSS score of 5.4.
How does CVE-2022-20781 affect Cisco AsyncOS Software?
CVE-2022-20781 affects Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) with a version up to exclusive 14.5.
How does CVE-2022-20781 impact Cisco Web Security Appliance?
CVE-2022-20781 does not impact Cisco Web Security Appliance.
Is there a fix for CVE-2022-20781?
Cisco has released a security advisory with fixes and mitigations for CVE-2022-20781. Please refer to the Cisco Security Advisory for more details.