CVE-2023-20267

A vulnerability in the IP geolocation rules of Snort 3 could allow an unauthenticated, remote attacker to potentially bypass IP address restrictions. This vulnerability exists because the configuration for IP geolocation rules is not parsed properly. An attacker could exploit this vulnerability by spoofing an IP address until they bypass the restriction. A successful exploit could allow the attacker to bypass location-based IP address restrictions.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftdsnort3sip-bypass-LMz2ThKn	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-11-01 18:15

Updated : 2024-01-25 17:15

NVD link : CVE-2023-20267

Mitre link : CVE-2023-20267

CVE.ORG link : CVE-2023-20267

JSON object : View

Products Affected

cisco

firepower_threat_defense

CWE

NVD-CWE-noinfo CWE-284

Improper Access Control

{"id": "CVE-2023-20267", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "published": "2023-11-01T18:15:09.810", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftdsnort3sip-bypass-LMz2ThKn", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the IP geolocation rules of Snort 3 could allow an unauthenticated, remote attacker to potentially bypass IP address restrictions. This vulnerability exists because the configuration for IP geolocation rules is not parsed properly. An attacker could exploit this vulnerability by spoofing an IP address until they bypass the restriction. A successful exploit could allow the attacker to bypass location-based IP address restrictions."}, {"lang": "es", "value": "Una vulnerabilidad en las reglas de geolocalizaci\u00f3n de IP de Snort 3 podr\u00eda permitir que un atacante remoto no autenticado potencialmente evite las restricciones de direcciones IP. Esta vulnerabilidad existe porque la configuraci\u00f3n de las reglas de geolocalizaci\u00f3n de IP no se analiza correctamente. Un atacante podr\u00eda aprovechar esta vulnerabilidad falsificando una direcci\u00f3n IP hasta omitir la restricci\u00f3n. Un exploit exitoso podr\u00eda permitir al atacante omitir las restricciones de direcciones IP basadas en la ubicaci\u00f3n."}], "lastModified": "2024-01-25T17:15:42.653", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C09834D9-E0C1-49C9-92A9-4FF1F84D37FC", "versionEndIncluding": "7.3.1.1", "versionStartIncluding": "6.7.0"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}