CVE-2015-0693
HighSummary
Cisco Web Security Appliance (WSA) devices with software 8.5.0-ise-147 do not properly restrict use of the pickle Python module during certain tunnel-status checks, allowing local users to execute arbitrary Python code and gain privileges via a crafted pickle file.
Risk Assessment
This vulnerability may lead to unauthorized access to the system and execution of malicious code, posing a serious threat to the organization's security.
Recommendation
It is recommended to update the software to the latest version to mitigate this vulnerability and restrict access to the devices only to trusted users.
Other vulnerabilities in Cisco Web Security Appliance (WSA)
See all- CVE-2017-6750High
A vulnerability in AsyncOS for the Cisco Web Security Appliance (WSA) could allow an unauthenticated local attacker to log in to the device with the privileges of a limited user or an unauthenticated remote attacker to authenticate to certain areas of the web GUI.
- CVE-2016-1296High
The proxy engine on Cisco Web Security Appliance (WSA) devices with software 8.5.3-055, 9.1.0-000, and 9.5.0-235 allows remote attackers to bypass intended proxy restrictions via a malformed HTTP method.
Original NVD description (English source)
Cisco Web Security Appliance (WSA) devices with software 8.5.0-ise-147 do not properly restrict use of the pickle Python module during certain tunnel-status checks, which allows local users to execute arbitrary Python code and gain privileges via a crafted pickle file, aka Bug ID CSCut39259.