Vulnerabilities > CVE-2022-20942 - Incorrect Authorization vulnerability in Cisco Asyncos

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

cisco

CWE-863

NVD

Published: 2022-11-04

Updated: 2024-01-25

Summary

A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance, formerly known as Cisco Web Security Appliance (WSA), could allow an authenticated, remote attacker to retrieve sensitive information from an affected device, including user credentials. This vulnerability is due to weak enforcement of back-end authorization checks. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain confidential data that is stored on the affected device.

Vulnerable Configurations

Part	Description	Count
OS	Cisco Cisco Asyncos - Cisco Asyncos 7.1.1 Cisco Asyncos 7.1.2 Cisco Asyncos 7.1.3 Cisco Asyncos 7.1.4 Cisco Asyncos 7.1.5 Cisco Asyncos 7.1.5-102 Cisco Asyncos 7.3.1 Cisco Asyncos 7.3.2 Cisco Asyncos 7.5 Cisco Asyncos 7.5.1 Cisco Asyncos 7.5.2 Cisco Asyncos 7.5.2-101 Cisco Asyncos 7.6.1 Cisco Asyncos 7.6.1-101 Cisco Asyncos 7.6.2 Cisco Asyncos 7.6.3 Cisco Asyncos 7.8 Cisco Asyncos 8.0 Cisco Asyncos 8.0.1 Cisco Asyncos 8.0.2 Cisco Asyncos 8.5 Cisco Asyncos 8.5.5 Cisco Asyncos 8.5.6 Cisco Asyncos 8.5.7 Cisco Asyncos 9.0 Cisco Asyncos 9.1 Cisco Asyncos 9.1.1 Cisco Asyncos 9.1.1-005 Cisco Asyncos 9.1.2 Cisco Asyncos 9.5 Cisco Asyncos 9.6 Cisco Asyncos 9.6.0 Cisco Asyncos 9.7 Cisco Asyncos 9.7.0-125 Cisco Asyncos 9.7.1 Cisco Asyncos 9.7.2 Cisco Asyncos 9.7.2-065 Cisco Asyncos 9.8 Cisco Asyncos 9.8.1 Cisco Asyncos 10.0 Cisco Asyncos 10.0.0 Cisco Asyncos 10.0.1 Cisco Asyncos 10.0.2 Cisco Asyncos 10.0.3 Cisco Asyncos 10.1.0 Cisco Asyncos 10.1.1-230 Cisco Asyncos 10.1.1-234 Cisco Asyncos 10.1.1-235 Cisco Asyncos 10.1.2-036 Cisco Asyncos 10.1.3-054 Cisco Asyncos 10.1.4-007 Cisco Asyncos 10.5 Cisco Asyncos 10.5.1-296 Cisco Asyncos 10.5.5-005 Cisco Asyncos 11.0 Cisco Asyncos 11.0.0 Cisco Asyncos 11.0.1 Cisco Asyncos 11.0.1-161 Cisco Asyncos 11.0.2 Cisco Asyncos 11.0.2-044_Md Cisco Asyncos 11.0.3 Cisco Asyncos 11.0.3-251 Cisco Asyncos 11.1 Cisco Asyncos 11.1.0 Cisco Asyncos 11.1.1 Cisco Asyncos 11.1.2 Cisco Asyncos 11.1.2-023_Md Cisco Asyncos 11.1.3 Cisco Asyncos 11.5 Cisco Asyncos 11.5.2-020 Cisco Asyncos 11.5.3-016 Cisco Asyncos 11.7 Cisco Asyncos 11.7.0-406 Cisco Asyncos 11.7.0-407 Cisco Asyncos 11.7.0-418 Cisco Asyncos 11.7.1-006 Cisco Asyncos 11.7.1-020 Cisco Asyncos 11.7.1-049 Cisco Asyncos 11.7.2-011 Cisco Asyncos 11.8 Cisco Asyncos 11.8.0 Cisco Asyncos 11.8.0-414 Cisco Asyncos 11.8.1-023 Cisco Asyncos 11.8.2-009 Cisco Asyncos 11.8.3-018 Cisco Asyncos 11.8.3-021 Cisco Asyncos 12.0 Cisco Asyncos 12.0.0 Cisco Asyncos 12.0.1-268 Cisco Asyncos 12.0.2 Cisco Asyncos 12.0.3-005 Cisco Asyncos 12.0.3-007 Cisco Asyncos 12.0.5-011 Cisco Asyncos 12.1 Cisco Asyncos 12.1.0-085 Cisco Asyncos 12.5 Cisco Asyncos 12.5.0 Cisco Asyncos 12.5.0-059 Cisco Asyncos 12.5.0-633 Cisco Asyncos 12.5.1-011 Cisco Asyncos 12.5.2-007 Cisco Asyncos 12.5.4-005 Cisco Asyncos 12.5.5 Cisco Asyncos 12.5.5-004 Cisco Asyncos 12.7 Cisco Asyncos 13.0 Cisco Asyncos 13.0.0 Cisco Asyncos 13.0.4 Cisco Asyncos 13.5.0 Cisco Asyncos 13.5.1 Cisco Asyncos 13.5.1-277 Cisco Asyncos 13.5.2 Cisco Asyncos 13.5.3-010 Cisco Asyncos 13.6 Cisco Asyncos 13.6.1 Cisco Asyncos 13.6.1-193 Cisco Asyncos 13.7.0-093 Cisco Asyncos 14.0 Cisco Asyncos 14.0.1 Cisco Asyncos 14.0.1-014 Cisco Asyncos 14.0.2-012 Cisco Asyncos 14.0.3-014 Cisco Asyncos 14.0.4 Cisco Asyncos 14.0.4-005 Cisco Asyncos 14.1 Cisco Asyncos 14.2.0 Cisco Asyncos 14.2.0-217 Cisco Asyncos 14.2.1 Cisco Asyncos 14.3.0 Cisco Asyncos 14.3.0-023	199
Hardware	Cisco Cisco Secure Email Gateway - Cisco Secure Email AND WEB Manager - Cisco Secure WEB Appliance -	3

Common Weakness Enumeration (CWE)

CWE-863 - Incorrect Authorization

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cnt-sec-infodiscl-BVKKnUG