Weak Authorization in Cisco Email Security Appliance and Web Manager

CVE-2022-20942

What is CVE-2022-20942?

A vulnerability present in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance arises from weak enforcement of back-end authorization checks. This enables authenticated remote attackers to send specifically crafted HTTP requests to the affected devices, leading to potential retrieval of sensitive information, including user credentials. The exploitation of this vulnerability poses significant risks as confidential data on the affected devices may be accessed without adequate authorization.

References