Lucene search

CiscoCVE-2022-20772

HistoryNov 04, 2022 - 6:15 p.m.

CVE-2022-20772

2022-11-0418:15:10

CWE-113

CWE-74

cisco

web.nvd.nist.gov

vulnerability

cisco

email security appliance

esa

secure email and web manager

http response splitting

attack

nvd

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

46.7%

JSON

A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack.

This vulnerability is due to the failure of the application or its environment to properly sanitize input values. An attacker could exploit this vulnerability by injecting malicious HTTP headers, controlling the response body, or splitting the response into multiple responses.

Affected configurations

Nvd

Node

ciscoemail_security_applianceMatch-

AND

ciscoemail_security_appliance_firmwareRange13.5.1–14.0.3-015

ciscoemail_security_appliance_firmwareRange14.1–14.2.1-015

ciscoemail_security_appliance_firmwareRange14.3–14.3.0-023

Node

ciscosecure_email_and_web_managerMatch-

AND

ciscosecure_email_and_web_manager_firmwareRange14.2–14.2.0-217

ciscosecure_email_and_web_manager_firmwareRange14.3–14.3.0-115

VendorProductVersionCPE
ciscoemail_security_appliance-cpe:2.3:h:cisco:email_security_appliance:-:*:*:*:*:*:*:*
ciscoemail_security_appliance_firmware*cpe:2.3:o:cisco:email_security_appliance_firmware:*:*:*:*:*:*:*:*
ciscosecure_email_and_web_manager-cpe:2.3:h:cisco:secure_email_and_web_manager:-:*:*:*:*:*:*:*
ciscosecure_email_and_web_manager_firmware*cpe:2.3:o:cisco:secure_email_and_web_manager_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	email_security_appliance	-	cpe:2.3:h:cisco:email_security_appliance:-:::::::*
cisco	email_security_appliance_firmware	*	cpe:2.3:o:cisco:email_security_appliance_firmware::::::::
cisco	secure_email_and_web_manager	-	cpe:2.3:h:cisco:secure_email_and_web_manager:-:::::::*
cisco	secure_email_and_web_manager_firmware	*	cpe:2.3:o:cisco:secure_email_and_web_manager_firmware::::::::

CNA Affected

[
  {
    "vendor": "Cisco",
    "product": "Cisco Secure Email",
    "versions": [
      {
        "version": "13.5.1-277",
        "status": "affected"
      },
      {
        "version": "14.0.0-698",
        "status": "affected"
      },
      {
        "version": "14.2.0-620",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Cisco",
    "product": "Cisco Secure Email and Web Manager",
    "versions": [
      {
        "version": "14.0.0-404",
        "status": "affected"
      },
      {
        "version": "14.1.0-223",
        "status": "affected"
      },
      {
        "version": "14.1.0-227",
        "status": "affected"
      },
      {
        "version": "14.2.0-212",
        "status": "affected"
      }
    ]
  }
]

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ESA-HTTP-Inject-nvsycUmR

Social References

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

46.7%

JSON

Related for CVE-2022-20772