CVE-2020-3299
MediumCVSS 5.8Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
A vulnerability in the Snort detection engine of multiple Cisco products could allow an unauthenticated, remote attacker to bypass a configured File Policy for HTTP. The issue is due to incorrect detection of modified HTTP packets used in chunked responses. An attacker could send crafted HTTP packets through an affected device, potentially bypassing the policy and delivering a malicious payload.
Risk Assessment
The risk is that an attacker can bypass security policies and deliver malware to the protected network.
Recommendation
It is recommended to upgrade to a patched version and review file policy configurations.
Original NVD description (English source)
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured File Policy for HTTP. The vulnerability is due to incorrect detection of modified HTTP packets used in chunked responses. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass a configured File Policy for HTTP packets and deliver a malicious payload.