Incorrect authorization in Cisco AsyncOS for Secure Web Appliance and Cisco AsyncOS for Cisco Email Security Appliance - CVE-2022-20942
Published: November 4, 2022
Vulnerability identifier: #VU68969
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-20942
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to weak enforcement of back-end authorization checks within the web-based management interface. A remote authenticated user can send a specially crafted HTTP request to the affected device and obtain confidential data that is stored on the affected device.
Affected software
Cisco AsyncOS for Secure Web Appliance
Cisco AsyncOS for Cisco Email Security Appliance
Cisco AsyncOS for Cisco Email Security Appliance
How to mitigate CVE-2022-20942
Install updates from vendor's website.
Cisco AsyncOS for Secure Web Appliance - addressed in versions 12.0.5-011, 12.5.4-005, 14.0.2-012
Cisco AsyncOS for Cisco Email Security Appliance - addressed in versions 14.2.1-015, 14.3.0-023
Cisco AsyncOS for Cisco Email Security Appliance - addressed in versions 14.2.1-015, 14.3.0-023