HTTP Response Splitting Vulnerability in Cisco Email Security Appliances

CVE-2022-20772

What is CVE-2022-20772?

A vulnerability exists in Cisco Email Security Appliance and Cisco Secure Email and Web Manager that could allow an unauthenticated remote attacker to conduct an HTTP response splitting attack. This issue arises from the application’s failure to properly sanitize input values, making it possible for an attacker to inject malicious HTTP headers. By doing so, they can manipulate the response body or partition the response into multiple parts, leading to potential security breaches.

References