Detections
Analytics
Cisco IOS XE Software Web Services DoS (cisco-sa-http-dos-svOdkdBS)
high Nessus Plugin ID 161364
Language:
Synopsis
The remote device is missing a vendor-supplied security patchDescription
According to its self-reported version, Cisco IOS-XE Software is affected by a denial of service vulnerability due to improper resource management in the HTTP server code. An authenticated, remote attacker can exploit this by sending a large number of HTTP requests to an affected device to cause the device to reload, resulting in a DoS condition.Please see the included Cisco BID and Cisco Security Advisory for more information.
Solution
Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvx42406See Also
http://www.nessus.org/u?1a1d2a6d
https://tools.cisco.com/security/center/viewErp.x?alertId=ERP-74561
Plugin Details
Severity: High
ID: 161364
File Name: cisco-sa-http-dos-svOdkdBS-iosxe.nasl
Version: 1.5
Type: combined
Family: CISCO
Published: 5/19/2022
Updated: 5/19/2022
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C
CVSS Score Source: CVE-2022-20697
CVSS v3
Risk Factor: High
Base Score: 8.6
Temporal Score: 7.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:cisco:ios_xe
Required KB Items: Host/Cisco/IOS-XE/Version
Exploit Ease: No known exploits are available
Patch Publication Date: 4/13/2022
Vulnerability Publication Date: 4/13/2022
Reference Information
CVE: CVE-2022-20697