Sign-up

ID

VAR-202211-0266


CVE

CVE-2022-20772


TITLE

Cisco Systems  Cisco E  Email   Security   appliance firmware and  Cisco Secure Email and Web Manager  Injection vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-022865

DESCRIPTION

A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This vulnerability is due to the failure of the application or its environment to properly sanitize input values. An attacker could exploit this vulnerability by injecting malicious HTTP headers, controlling the response body, or splitting the response into multiple responses

Trust: 1.62

sources: NVD: CVE-2022-20772 // JVNDB: JVNDB-2022-022865

AFFECTED PRODUCTS

vendor:ciscomodel:email security appliancescope:gteversion:14.3

Trust: 1.0

vendor:ciscomodel:email security appliancescope:ltversion:14.0.3-015

Trust: 1.0

vendor:ciscomodel:email security appliancescope:ltversion:14.3.0-023

Trust: 1.0

vendor:ciscomodel:secure email and web managerscope:gteversion:14.2

Trust: 1.0

vendor:ciscomodel:secure email and web managerscope:ltversion:14.2.0-217

Trust: 1.0

vendor:ciscomodel:email security appliancescope:ltversion:14.2.1-015

Trust: 1.0

vendor:ciscomodel:secure email and web managerscope:ltversion:14.3.0-115

Trust: 1.0

vendor:ciscomodel:email security appliancescope:gteversion:14.1

Trust: 1.0

vendor:ciscomodel:email security appliancescope:gteversion:13.5.1

Trust: 1.0

vendor:ciscomodel:secure email and web managerscope:gteversion:14.3

Trust: 1.0

vendor:シスコシステムズmodel:cisco secure email and web managerscope:eqversion:14.3 that's all 14.3.0-115

Trust: 0.8

vendor:シスコシステムズmodel:cisco e メール セキュリティ アプライアンスscope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco secure email and web managerscope:eqversion:14.2 that's all 14.2.0-217

Trust: 0.8

sources: JVNDB: JVNDB-2022-022865 // NVD: CVE-2022-20772

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-20772
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2022-20772
value: MEDIUM

Trust: 1.0

NVD: CVE-2022-20772
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202211-1945
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2022-20772
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.1

Trust: 1.0

ykramarz@cisco.com: CVE-2022-20772
baseSeverity: MEDIUM
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 1.4
version: 3.1

Trust: 1.0

NVD: CVE-2022-20772
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-022865 // CNNVD: CNNVD-202211-1945 // NVD: CVE-2022-20772 // NVD: CVE-2022-20772

PROBLEMTYPE DATA

problemtype:CWE-113

Trust: 1.0

problemtype:CWE-74

Trust: 1.0

problemtype:injection (CWE-74) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-022865 // NVD: CVE-2022-20772

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202211-1945

TYPE

injection

Trust: 0.6

sources: CNNVD: CNNVD-202211-1945

PATCH

title:cisco-sa-ESA-HTTP-Inject-nvsycUmRurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ESA-HTTP-Inject-nvsycUmR

Trust: 0.8

sources: JVNDB: JVNDB-2022-022865

EXTERNAL IDS

db:NVDid:CVE-2022-20772

Trust: 3.2

db:JVNDBid:JVNDB-2022-022865

Trust: 0.8

db:CNNVDid:CNNVD-202211-1945

Trust: 0.6

sources: JVNDB: JVNDB-2022-022865 // CNNVD: CNNVD-202211-1945 // NVD: CVE-2022-20772

REFERENCES

url:https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-esa-http-inject-nvsycumr

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2022-20772

Trust: 0.8

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-esa-http-inject-nvsycumr

Trust: 0.6

url:https://vigilance.fr/vulnerability/cisco-esa-sewm-header-injection-39814

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-20772/

Trust: 0.6

sources: JVNDB: JVNDB-2022-022865 // CNNVD: CNNVD-202211-1945 // NVD: CVE-2022-20772

SOURCES

db:JVNDBid:JVNDB-2022-022865
db:CNNVDid:CNNVD-202211-1945
db:NVDid:CVE-2022-20772

LAST UPDATE DATE

2024-08-14T15:42:10.885000+00:00


SOURCES UPDATE DATE

db:JVNDBid:JVNDB-2022-022865date:2023-11-21T02:48:00
db:CNNVDid:CNNVD-202211-1945date:2022-11-09T00:00:00
db:NVDid:CVE-2022-20772date:2024-01-25T17:15:15.223

SOURCES RELEASE DATE

db:JVNDBid:JVNDB-2022-022865date:2023-11-21T00:00:00
db:CNNVDid:CNNVD-202211-1945date:2022-11-02T00:00:00
db:NVDid:CVE-2022-20772date:2022-11-04T18:15:10.843