SQL Injection Vulnerability in Cisco Email Security Appliance

CVE-2022-20867

Summary

A vulnerability in the web-based management interface of the Cisco Email Security Appliance could enable an authenticated remote attacker to execute SQL injection attacks with root-level access. This flaw arises from the improper validation of user-submitted parameters, permitting an attacker with high-privilege user credentials to issue malicious requests. By exploiting this vulnerability, an attacker could compromise sensitive data and alter stored information within the underlying database, posing significant security risks to affected systems.

References