Back to the CVE list
CVE-2022-20713

Cross-site scripting in Cisco Secure Firewall Threat Defense

CVSS score

6.1

EPSS probability

%1.8

Risk score

0.1

Published

4 y ago

OverviewPublic Exploits (0)NewsroomVulnerability Timeline
Patch status has not yet been verified

Resmî kaynaklarda yeterli kanıt bulunamadı. Bu sonuç “yama yok” anlamına gelmez.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2022-20713 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

A vulnerability in the VPN web client services component of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct browser-based attacks against users of an affected device. This vulnerability is due to improper validation of input that is passed to the VPN web client services component before being returned to the browser that is in use. An attacker could exploit this vulnerability by persuading a user to visit a website that is designed to pass malicious requests to a device that is running Cisco ASA Software or Cisco FTD Software and has web services endpoints supporting VPN features enabled. A successful exploit could allow the attacker to reflect malicious input from the affected device to the browser that is in use and conduct browser-based attacks, including cross-site scripting attacks. The attacker could not directly impact the affected device.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2022-20713 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

IDVENDORPRODUCTACTION
1ciscosecure firewall threat defense View
2ciscosecure firewall threat defense View
3ciscosecure firewall threat defense View
4ciscosecure firewall threat defense View
5ciscosecure firewall threat defense View
6ciscosecure firewall threat defense View
7ciscosecure firewall threat defense View
8ciscosecure firewall threat defense View
9ciscosecure firewall threat defense View
10ciscosecure firewall threat defense View
11ciscosecure firewall threat defense View
12ciscosecure firewall threat defense View
13ciscosecure firewall threat defense View
14ciscosecure firewall threat defense View
15ciscosecure firewall threat defense View
16ciscosecure firewall threat defense View
17ciscosecure firewall threat defense View
18ciscosecure firewall threat defense View
19ciscosecure firewall threat defense View
20ciscosecure firewall threat defense View
21ciscosecure firewall threat defense View
22ciscosecure firewall threat defense View
23ciscosecure firewall threat defense View
24ciscosecure firewall threat defense View
25ciscosecure firewall threat defense View
26ciscosecure firewall threat defense View
27ciscosecure firewall threat defense View
28ciscosecure firewall threat defense View
29ciscosecure firewall threat defense View
30ciscosecure firewall threat defense View
31ciscosecure firewall threat defense View
32ciscosecure firewall threat defense View
33ciscosecure firewall threat defense View
34ciscosecure firewall threat defense View
35ciscosecure firewall threat defense View
36ciscosecure firewall threat defense View
37ciscosecure firewall threat defense View
38ciscosecure firewall threat defense View
39ciscosecure firewall threat defense View
40ciscosecure firewall threat defense View
41ciscosecure firewall threat defense View
42ciscosecure firewall threat defense View
43ciscosecure firewall threat defense View
44ciscosecure firewall threat defense View
45ciscosecure firewall threat defense View
46ciscosecure firewall threat defense View
47ciscosecure firewall threat defense View
48ciscosecure firewall threat defense View
49ciscosecure firewall threat defense View
50ciscosecure firewall threat defense View
51ciscosecure firewall threat defense View
52ciscosecure firewall threat defense View
53ciscosecure firewall threat defense View
54ciscosecure firewall threat defense View
55ciscosecure firewall threat defense View
56ciscosecure firewall threat defense View
57ciscosecure firewall threat defense View
58ciscosecure firewall threat defense View
59ciscosecure firewall threat defense View
60ciscosecure firewall threat defense View
61ciscosecure firewall threat defense View
62ciscosecure firewall threat defense View
63ciscosecure firewall threat defense View
64ciscosecure firewall threat defense View
65ciscosecure firewall threat defense View
66ciscosecure firewall threat defense View
67ciscosecure firewall threat defense View
68ciscosecure firewall threat defense View
69ciscosecure firewall threat defense View
70ciscosecure firewall threat defense View
71ciscosecure firewall threat defense View
72ciscoadaptive security appliance software View
73ciscoadaptive security appliance software View
74ciscoadaptive security appliance software View
75ciscoadaptive security appliance software View
76ciscoadaptive security appliance software View
77ciscoadaptive security appliance software View
78ciscoadaptive security appliance software View
79ciscoadaptive security appliance software View
80ciscoadaptive security appliance software View
81ciscoadaptive security appliance software View
82ciscoadaptive security appliance software View
83ciscoadaptive security appliance software View
84ciscoadaptive security appliance software View
85ciscoadaptive security appliance software View
86ciscoadaptive security appliance software View
87ciscoadaptive security appliance software View
88ciscoadaptive security appliance software View
89ciscoadaptive security appliance software View
90ciscoadaptive security appliance software View
91ciscoadaptive security appliance software View
92ciscoadaptive security appliance software View
93ciscoadaptive security appliance software View
94ciscoadaptive security appliance software View
95ciscoadaptive security appliance software View
96ciscoadaptive security appliance software View
97ciscoadaptive security appliance software View
98ciscoadaptive security appliance software View
99ciscoadaptive security appliance software View
100ciscoadaptive security appliance software View
101ciscoadaptive security appliance software View
102ciscoadaptive security appliance software View
103ciscoadaptive security appliance software View
104ciscoadaptive security appliance software View
105ciscoadaptive security appliance software View
106ciscoadaptive security appliance software View
107ciscoadaptive security appliance software View
108ciscoadaptive security appliance software View
109ciscoadaptive security appliance software View
110ciscoadaptive security appliance software View
111ciscoadaptive security appliance software View
112ciscoadaptive security appliance software View
113ciscoadaptive security appliance software View
114ciscoadaptive security appliance software View
115ciscoadaptive security appliance software View
116ciscoadaptive security appliance software View
117ciscoadaptive security appliance software View
118ciscoadaptive security appliance software View
119ciscoadaptive security appliance software View
120ciscoadaptive security appliance software View
121ciscoadaptive security appliance software View
122ciscoadaptive security appliance software View
123ciscoadaptive security appliance software View
124ciscoadaptive security appliance software View
125ciscoadaptive security appliance software View
126ciscoadaptive security appliance software View
127ciscoadaptive security appliance software View
128ciscoadaptive security appliance software View
129ciscoadaptive security appliance software View
130ciscoadaptive security appliance software View
131ciscoadaptive security appliance software View
132ciscoadaptive security appliance software View
133ciscoadaptive security appliance software View
134ciscoadaptive security appliance software View
135ciscoadaptive security appliance software View
136ciscoadaptive security appliance software View
137ciscoadaptive security appliance software View
138ciscoadaptive security appliance software View
139ciscoadaptive security appliance software View
140ciscoadaptive security appliance software View
141ciscoadaptive security appliance software View
142ciscoadaptive security appliance software View
143ciscoadaptive security appliance software View
144ciscoadaptive security appliance software View
145ciscoadaptive security appliance software View
146ciscoadaptive security appliance software View
147ciscoadaptive security appliance software View
148ciscoadaptive security appliance software View
149ciscoadaptive security appliance software View
150ciscoadaptive security appliance software View
151ciscoadaptive security appliance software View
152ciscoadaptive security appliance software View
153ciscoadaptive security appliance software View
154ciscoadaptive security appliance software View
155ciscoadaptive security appliance software View
156ciscoadaptive security appliance software View
157ciscoadaptive security appliance software View
158ciscoadaptive security appliance software View
159ciscoadaptive security appliance software View
160ciscoadaptive security appliance software View
161ciscoadaptive security appliance software View
162ciscoadaptive security appliance software View
163ciscoadaptive security appliance software View
164ciscoadaptive security appliance software View
165ciscoadaptive security appliance software View
166ciscoadaptive security appliance software View
167ciscoadaptive security appliance software View
168ciscoadaptive security appliance software View
169ciscoadaptive security appliance software View
170ciscoadaptive security appliance software View
171ciscoadaptive security appliance software View
172ciscoadaptive security appliance software View
173ciscoadaptive security appliance software View
174ciscoadaptive security appliance software View
175ciscoadaptive security appliance software View
176ciscoadaptive security appliance software View
177ciscoadaptive security appliance software View
178ciscoadaptive security appliance software View
179ciscoadaptive security appliance software View
180ciscoadaptive security appliance software View
181ciscoadaptive security appliance software View
182ciscoadaptive security appliance software View
183ciscoadaptive security appliance software View
184ciscoadaptive security appliance software View
185ciscoadaptive security appliance software View
186ciscoadaptive security appliance software View
187ciscoadaptive security appliance software View
188ciscoadaptive security appliance software View
189ciscoadaptive security appliance software View
190ciscoadaptive security appliance software View
191ciscoadaptive security appliance software View
192ciscoadaptive security appliance software View
193ciscoadaptive security appliance software View
194ciscoadaptive security appliance software View
195ciscoadaptive security appliance software View
196ciscoadaptive security appliance software View
197ciscoadaptive security appliance software View
198ciscoadaptive security appliance software View
199ciscoadaptive security appliance software View
200ciscoadaptive security appliance software View
Total affected vendors: 1|Products: 200

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
6.1CVSS V31MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NNVD
4.3CVSS V31MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NNVD

Patch and Remediation Guide

Solution & Remediation Advisory

Patch status unknown

İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.

Confirm the affected product and version against the source evidence above.
Restrict access to internet-facing services and apply network segmentation.
Until a patch is confirmed, follow the vendor advisory; do not read an unknown status as “no patch”.
Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2022-20713 is associated with the following CWEs:

CWE-444: Common Weakness Enumeration Entry CWE-444CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2022-20713 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureAğ üzerinden
PermissionsGerekmiyor
UserGerekiyor

Official Sources and Advisories

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-webvpn-LOeKsNmOvendor-advisory

CVSS Vector Radar Chart

6.1 / 10
Attack VectorNetworkComplexityLowPrivilegesNoneUser Interact.RequiredConfidentialityLowIntegrityLowAvailabilityNone

Vulnerability Scoring Details

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone required
User Interaction—
Confidentiality (Gizlilik)Low
Integrity (Bütünlük)Low
Availability (Erişilebilirlik)None

Yama durumu bilinmiyor

İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.

Follow the vendor

C
cisco logo
cisco

Weakness Type (CWE & CAPEC)

CWE-444 CWE-79

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2022-20713"