CVE-2022-20664: cisco cisco email security appliance (esa)

Vulnerability summary

CVE-2022-20664 is a high (CVSS 7.7) vulnerability in cisco cisco email security appliance (esa). EPSS estimates a 1.03% chance of exploitation in the next 30 days, higher than 63.3% of scored vulnerabilities.

Timeline

1. 15-06-2022
   PublishedVulnerability first disclosed.
2. 06-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the web management interface of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance (ESA) could allow an authenticated, remote attacker to retrieve sensitive information from a Lightweight Directory Access Protocol (LDAP) external authentication server connected to an affected device. This vulnerability is due to a lack of proper input sanitization while querying the external authentication server. An attacker could exploit this vulnerability by sending a crafted query through an external authentication web page. A successful exploit could allow the attacker to gain access to sensitive information, including user credentials from the external authentication server. To exploit this vulnerability, an attacker would need valid operator-level (or higher) credentials.

• CWE-497Exposure of Sensitive System Information to an Unauthorized Control SphereThe product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.