CVE-2022-20798
published 2022-06-15CVE-2022-20798: A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly known as Cisco Security Management Appliance…
PriorityP266critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.43%
69.8th percentile
A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly known as Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass authentication and log in to the web management interface of an affected device. This vulnerability is due to improper authentication checks when an affected device uses Lightweight Directory Access Protocol (LDAP) for external authentication. An attacker could exploit this vulnerability by entering a specific input on the login page of the affected device. A successful exploit could allow the attacker to gain unauthorized access to the web-based management interface of the affected device.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_email_security_appliance | — | — |
| cisco | email_security_appliance | — | — |
| cisco | email_security_appliance | >= 14.0 < 14.0.1-033 | 14.0.1-033 |
| cisco | email_security_appliance_and_cisco_secure_email_and_web_manager_external | — | — |
| cisco | secure_email_and_web_manager | >= 13.0 < 13.0.0-277 | 13.0.0-277 |
| cisco | secure_email_and_web_manager | >= 13.6 < 13.6.2-090 | 13.6.2-090 |
| cisco | secure_email_and_web_manager | >= 13.8 < 13.8.1-090 | 13.8.1-090 |
| cisco | secure_email_and_web_manager | >= 14.0 < 14.0.0-418 | 14.0.0-418 |
| cisco | secure_email_and_web_manager | >= 14.1 < 14.1.0-250 | 14.1.0-250 |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit targets the web management interface login page of Cisco ESA/SMA when LDAP external authentication is enabled; monitor for authentication bypass attempts (successful logins with anomalous or empty/special input) against the web management interface ↗
- →Scope detection to devices configured with LDAP external authentication; successful exploitation results in unauthorized access to the web-based management interface — alert on unexpected admin sessions from unauthenticated or unknown sources ↗
- →Track Cisco bug IDs CSCvx88026 and CSCvy13453 for patch status on affected Cisco Secure Email and Web Manager (SMA) and Email Security Appliance (ESA) devices ↗
- ·Vulnerability is only exploitable when the affected device is configured to use LDAP for external authentication; devices using local authentication are not affected ↗
- ·A workaround exists in addition to the software fix; consult the Cisco advisory for workaround details to mitigate exposure on unpatched devices ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_cisco9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Email Security Appliance and Cisco Secure Email and Web Manager External Authentication Bypass Vulnerability
vendor_cisco·2022-06-15·CVSS 9.8
CVE-2022-20798 [CRITICAL] CWE-287 Cisco Email Security Appliance and Cisco Secure Email and Web Manager External Authentication Bypass Vulnerability
Cisco Email Security Appliance and Cisco Secure Email and Web Manager External Authentication Bypass Vulnerability
A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly known as Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass authentication and log in to the web management interface of an affected device.
This vulnerability is due to improper authentication checks when an affected device uses Lightweight Directory Access Protocol (LDAP) for external authentication. An attacker could exploit this vulnerability by entering a specific input on the login page of the affected device. A successful exploit could allow the attacker to gain unauthori
Cisco
Cisco Email Security Appliance and Cisco Secure Email and Web Manager External Authentication Bypass Vulnerability
vendor_cisco·CVSS 3.1
CVE-2022-20798 Cisco Email Security Appliance and Cisco Secure Email and Web Manager External Authentication Bypass Vulnerability
CVE-2022-20798: Cisco Email Security Appliance and Cisco Secure Email and Web Manager External Authentication Bypass Vulnerability
A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly known as Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass authentication and log in to the web management interface of an affected device. This vulnerability is due to improper authentication checks when an affected device uses Lightweight Directory Access Protocol (LDAP) for external authentication. An attacker could exploit this vulnerability by entering a specific input on the login page of the affected device. A successful exploit could allow the attacker to
GHSA
GHSA-c457-6cm5-j5m6: A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly known as Cisco Security Management Applia
ghsa_unreviewed·2022-06-16
CVE-2022-20798 [CRITICAL] CWE-287 GHSA-c457-6cm5-j5m6: A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly known as Cisco Security Management Applia
A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly known as Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass authentication and log in to the web management interface of an affected device. This vulnerability is due to improper authentication checks when an affected device uses Lightweight Directory Access Protocol (LDAP) for external authentication. An attacker could exploit this vulnerability by entering a specific input on the login page of the affected device. A successful exploit could allow the attacker to gain unauthorized access to the web-based management interface of the affected device.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-06-15
Published