Cisco Web Security Appliance HTTPS Certificate Denial of Service Vulnerability
Cisco · Cisco Web Security Appliance (WSA)
A vulnerability in the HTTPS decryption feature of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to insufficient validation of Secure Sockets Layer (SSL) server certificates. An attacker could exploit this vulnerability by installing a malformed certificate in a web server and sending a request to it through the Cisco WSA. A successful exploit could allow the attacker to cause an unexpected restart of the proxy process on an affected device.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 1/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.What they do
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 4 Jul 2019. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
1 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 1ImpactTA0040
Detection
0 rules for this CVE · 20 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2019-1886 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Service StopT148920 general rules
- Delete All Scheduled Taskshightest
- Delete Important Scheduled Taskhightest
- Disable Important Scheduled Taskhightest
- Important Scheduled Task Deleted or Disabledhightest
- Suspicious Windows Service Tamperinghightest
- Azure Application Deletedmediumtest
- Azure Kubernetes Network Policy Changemediumtest
- Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deletedmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.