PT-2022-2551 · Cisco · Cisco Umbrella Secure Web Gateway

Alexandre Samuel + 1 · Published 2022-04-20 · Updated 2023-07-24 · CVE-2022-20805

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Umbrella Secure Web Gateway (SWG) (affected versions not specified)

Description A vulnerability in the automatic decryption process could allow an authenticated, adjacent attacker to bypass the SSL decryption and content filtering policies on an affected system. This issue is due to how the decryption function uses the TLS Server Name Indication (SNI) extension of an HTTP request to discover the destination domain and determine if the request needs to be decrypted. An attacker could exploit this by sending a crafted request over TLS from a client to an unknown or controlled URL, potentially allowing malicious content to be downloaded to a host on a protected network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Protection Mechanism Failure

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-693

CWE-327

Related Identifiers

BDU:2022-02975

CVE-2022-20805

Affected Products

Cisco Umbrella Secure Web Gateway

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-20805 · Security Note
• https://bdu.fstec.ru/vul/2022-02975 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-uswg-fdbps-xtTRKpp6 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2022042123 · Note
• https://t.me/cibsecurity/41255 · Telegram Post