Privilege Escalation Vulnerability in Cisco Email Security Appliance

CVE-2022-20868

What is CVE-2022-20868?

A vulnerability exists in the web-based management interface of Cisco’s Email Security Appliance, Secure Email and Web Manager, and Secure Web Appliance. This flaw allows an authenticated remote attacker to elevate their privileges by exploiting a hardcoded value utilized for encrypting tokens in certain API calls. By authenticating and sending a specially crafted HTTP request, the attacker can impersonate another legitimate user, executing commands with the authority of that user. This could pose significant risks, particularly in environments where access to sensitive information and functionalities is controlled through user privileges.

References