CVE-2022-20868 (GCVE-0-2022-20868)

Vulnerability from cvelistv5 – Published: 2022-11-03 19:29 – Updated: 2024-08-03 02:24
VLAI?
Summary
A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance could allow an authenticated, remote attacker to elevate privileges on an affected system. The attacker needs valid credentials to exploit this vulnerability. This vulnerability is due to the use of a hardcoded value to encrypt a token used for certain APIs calls . An attacker could exploit this vulnerability by authenticating to the device and sending a crafted HTTP request. A successful exploit could allow the attacker to impersonate another valid user and execute commands with the privileges of that user account.
Severity ?
4.7 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CWE
  • CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
Impacted products
Vendor Product Version
Cisco Cisco Secure Web Appliance Affected: 11.8.0-414
Affected: 11.8.1-023
Affected: 11.8.3-018
Affected: 11.8.3-021
Affected: 12.0.1-268
Affected: 12.0.3-007
Affected: 12.5.2-007
Affected: 12.5.1-011
Affected: 12.5.4-005
Affected: 14.5.0-498
Affected: 14.0.2-012
Create a notification for this product.
    Cisco Cisco Secure Email Affected: 13.0.0-392
Affected: 13.5.1-277
Affected: 14.0.0-698
Affected: 14.2.0-620
Create a notification for this product.
    Cisco Cisco Secure Email and Web Manager Affected: 12.0.0-452
Affected: 12.0.1-011
Affected: 12.5.0-636
Affected: 12.5.0-658
Affected: 12.5.0-678
Affected: 12.5.0-670
Affected: 13.0.0-277
Affected: 13.6.2-078
Affected: 13.8.1-068
Affected: 13.8.1-074
Affected: 12.8.1-002
Affected: 14.0.0-404
Affected: 14.1.0-223
Affected: 14.1.0-227
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:24:50.239Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "cisco-sa-esasmawsa-vulns-YRuSW5mD",
            "tags": [
              "x_transferred"
            ],
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esasmawsa-vulns-YRuSW5mD"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Secure Web Appliance",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "11.8.0-414"
            },
            {
              "status": "affected",
              "version": "11.8.1-023"
            },
            {
              "status": "affected",
              "version": "11.8.3-018"
            },
            {
              "status": "affected",
              "version": "11.8.3-021"
            },
            {
              "status": "affected",
              "version": "12.0.1-268"
            },
            {
              "status": "affected",
              "version": "12.0.3-007"
            },
            {
              "status": "affected",
              "version": "12.5.2-007"
            },
            {
              "status": "affected",
              "version": "12.5.1-011"
            },
            {
              "status": "affected",
              "version": "12.5.4-005"
            },
            {
              "status": "affected",
              "version": "14.5.0-498"
            },
            {
              "status": "affected",
              "version": "14.0.2-012"
            }
          ]
        },
        {
          "product": "Cisco Secure Email",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "13.0.0-392"
            },
            {
              "status": "affected",
              "version": "13.5.1-277"
            },
            {
              "status": "affected",
              "version": "14.0.0-698"
            },
            {
              "status": "affected",
              "version": "14.2.0-620"
            }
          ]
        },
        {
          "product": "Cisco Secure Email and Web Manager",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "12.0.0-452"
            },
            {
              "status": "affected",
              "version": "12.0.1-011"
            },
            {
              "status": "affected",
              "version": "12.5.0-636"
            },
            {
              "status": "affected",
              "version": "12.5.0-658"
            },
            {
              "status": "affected",
              "version": "12.5.0-678"
            },
            {
              "status": "affected",
              "version": "12.5.0-670"
            },
            {
              "status": "affected",
              "version": "13.0.0-277"
            },
            {
              "status": "affected",
              "version": "13.6.2-078"
            },
            {
              "status": "affected",
              "version": "13.8.1-068"
            },
            {
              "status": "affected",
              "version": "13.8.1-074"
            },
            {
              "status": "affected",
              "version": "12.8.1-002"
            },
            {
              "status": "affected",
              "version": "14.0.0-404"
            },
            {
              "status": "affected",
              "version": "14.1.0-223"
            },
            {
              "status": "affected",
              "version": "14.1.0-227"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance could allow an authenticated, remote attacker to elevate privileges on an affected system. The attacker needs valid credentials to exploit this vulnerability. \r\n\r\nThis vulnerability is due to the use of a hardcoded value to encrypt a token used for certain APIs calls . An attacker could exploit this vulnerability by authenticating to the device and sending a crafted HTTP request. A successful exploit could allow the attacker to impersonate another valid user and execute commands with the privileges of that user account.\r\n"
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-321",
              "description": "Use of Hard-coded Cryptographic Key",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-25T16:57:11.853Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-esasmawsa-vulns-YRuSW5mD",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esasmawsa-vulns-YRuSW5mD"
        }
      ],
      "source": {
        "advisory": "cisco-sa-esasmawsa-vulns-YRuSW5mD",
        "defects": [
          "CSCwc12181",
          "CSCwc12183",
          "CSCwc12184"
        ],
        "discovery": "EXTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2022-20868",
    "datePublished": "2022-11-03T19:29:31.722Z",
    "dateReserved": "2021-11-02T13:28:29.182Z",
    "dateUpdated": "2024-08-03T02:24:50.239Z",
    "requesterUserId": "4087f8c1-b21c-479b-99df-de23cb76b743",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"13.0\", \"versionEndExcluding\": \"14.2.1\", \"matchCriteriaId\": \"6A74DE82-C879-48E3-8E74-F03D18B8ECF4\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:secure_email_gateway:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AEFF3E86-0ED8-40CA-BD69-9FD67F32A31A\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"12.0\", \"versionEndExcluding\": \"14.2.0\", \"matchCriteriaId\": \"EACCC821-A995-43A9-9BA2-8A335A55FC99\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:secure_email_and_web_manager:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DB4207E0-A5C1-4945-B996-722933148C37\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"11.8\", \"versionEndExcluding\": \"12.5.5\", \"matchCriteriaId\": \"68AEA203-411D-40C8-AA2A-A0FB4D2789DB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"14.0\", \"versionEndExcluding\": \"14.0.4\", \"matchCriteriaId\": \"AE2447D4-9F35-4D76-BF77-F4E63DB57DA1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:asyncos:14.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2FFF4B58-3DAF-47D7-8569-5D3D27F14D22\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:secure_web_appliance:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"67074526-9933-46B3-9FE3-A0BE73C5E8A7\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance could allow an authenticated, remote attacker to elevate privileges on an affected system. The attacker needs valid credentials to exploit this vulnerability. \\r\\n\\r\\nThis vulnerability is due to the use of a hardcoded value to encrypt a token used for certain APIs calls . An attacker could exploit this vulnerability by authenticating to the device and sending a crafted HTTP request. A successful exploit could allow the attacker to impersonate another valid user and execute commands with the privileges of that user account.\\r\\n\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad en la interfaz de administraci\\u00f3n basada en web de Cisco Email Security Appliance, Cisco Secure Email and Web Manager y Cisco Secure Web Appliance podr\\u00eda permitir que un atacante remoto autenticado eleve los privilegios en un sistema afectado. El atacante necesita credenciales v\\u00e1lidas para aprovechar esta vulnerabilidad. Esta vulnerabilidad se debe al uso de un valor codificado a mano para cifrar un token utilizado para ciertas llamadas API. Un atacante podr\\u00eda aprovechar esta vulnerabilidad autentic\\u00e1ndose en el dispositivo y enviando una solicitud HTTP manipulada. Un exploit exitoso podr\\u00eda permitir al atacante hacerse pasar por otro usuario v\\u00e1lido y ejecutar comandos con los privilegios de esa cuenta de usuario.\"}]",
      "id": "CVE-2022-20868",
      "lastModified": "2024-11-21T06:43:43.140",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"ykramarz@cisco.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L\", \"baseScore\": 4.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 3.4}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}]}",
      "published": "2022-11-04T18:15:10.983",
      "references": "[{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esasmawsa-vulns-YRuSW5mD\", \"source\": \"ykramarz@cisco.com\"}, {\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esasmawsa-vulns-YRuSW5mD\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "ykramarz@cisco.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"ykramarz@cisco.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-321\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-798\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-20868\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2022-11-04T18:15:10.983\",\"lastModified\":\"2024-11-21T06:43:43.140\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance could allow an authenticated, remote attacker to elevate privileges on an affected system. The attacker needs valid credentials to exploit this vulnerability. \\r\\n\\r\\nThis vulnerability is due to the use of a hardcoded value to encrypt a token used for certain APIs calls . An attacker could exploit this vulnerability by authenticating to the device and sending a crafted HTTP request. A successful exploit could allow the attacker to impersonate another valid user and execute commands with the privileges of that user account.\\r\\n\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en la interfaz de administraci\u00f3n basada en web de Cisco Email Security Appliance, Cisco Secure Email and Web Manager y Cisco Secure Web Appliance podr\u00eda permitir que un atacante remoto autenticado eleve los privilegios en un sistema afectado. El atacante necesita credenciales v\u00e1lidas para aprovechar esta vulnerabilidad. Esta vulnerabilidad se debe al uso de un valor codificado a mano para cifrar un token utilizado para ciertas llamadas API. Un atacante podr\u00eda aprovechar esta vulnerabilidad autentic\u00e1ndose en el dispositivo y enviando una solicitud HTTP manipulada. Un exploit exitoso podr\u00eda permitir al atacante hacerse pasar por otro usuario v\u00e1lido y ejecutar comandos con los privilegios de esa cuenta de usuario.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.2,\"impactScore\":3.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-321\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-798\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"13.0\",\"versionEndExcluding\":\"14.2.1\",\"matchCriteriaId\":\"6A74DE82-C879-48E3-8E74-F03D18B8ECF4\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:secure_email_gateway:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AEFF3E86-0ED8-40CA-BD69-9FD67F32A31A\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"12.0\",\"versionEndExcluding\":\"14.2.0\",\"matchCriteriaId\":\"EACCC821-A995-43A9-9BA2-8A335A55FC99\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:secure_email_and_web_manager:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB4207E0-A5C1-4945-B996-722933148C37\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.8\",\"versionEndExcluding\":\"12.5.5\",\"matchCriteriaId\":\"68AEA203-411D-40C8-AA2A-A0FB4D2789DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"14.0\",\"versionEndExcluding\":\"14.0.4\",\"matchCriteriaId\":\"AE2447D4-9F35-4D76-BF77-F4E63DB57DA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:asyncos:14.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2FFF4B58-3DAF-47D7-8569-5D3D27F14D22\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:secure_web_appliance:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"67074526-9933-46B3-9FE3-A0BE73C5E8A7\"}]}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esasmawsa-vulns-YRuSW5mD\",\"source\":\"psirt@cisco.com\"},{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esasmawsa-vulns-YRuSW5mD\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.