A vulnerability in the management web server of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with high privileges to execute configuration commands on an affected system.
This vulnerability exists because access to HTTPS endpoints is not properly restricted on an affected device. An attacker could exploit this vulnerability by sending specific messages to the affected HTTPS handler. A successful exploit could allow the attacker to perform configuration changes on the affected system, which should be configured and managed only through Cisco Firepower Management Center (FMC) Software.
References
Configurations
Configuration 1 (hide)
|
History
25 Jan 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-399 | |
| References |
|
|
07 Nov 2023, 03:43
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | A vulnerability in the management web server of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with high privileges to execute configuration commands on an affected system. This vulnerability exists because access to HTTPS endpoints is not properly restricted on an affected device. An attacker could exploit this vulnerability by sending specific messages to the affected HTTPS handler. A successful exploit could allow the attacker to perform configuration changes on the affected system, which should be configured and managed only through Cisco Firepower Management Center (FMC) Software. |
22 Nov 2022, 14:49
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.9 |
| References | (MISC) https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-mgmt-privesc-7GqR2th - Patch, Vendor Advisory | |
| CWE | NVD-CWE-Other | |
| First Time |
Cisco
Cisco firepower Threat Defense |
|
| CPE | cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.1.0.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:6.2.1:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.1.0.2:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.2.0.1:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.1.0.1:*:*:*:*:*:*:* |
15 Nov 2022, 21:56
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-11-15 21:15
Updated : 2024-01-25 17:15
NVD link : CVE-2022-20949
Mitre link : CVE-2022-20949
CVE.ORG link : CVE-2022-20949
JSON object : View
Products Affected
cisco
- firepower_threat_defense
CWE