CVE-2022-20867: SQL Injection
First published: Thu Nov 03 2022(Updated: )
A vulnerability in web-based management interface of the of Cisco Email Security Appliance and Cisco Secure Email and Web Manager could allow an authenticated, remote attacker to conduct SQL injection attacks as root on an affected system. The attacker must have the credentials of a high-privileged user account. This vulnerability is due to improper validation of user-submitted parameters. An attacker could exploit this vulnerability by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain data or modify data that is stored in the underlying database of the affected system.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco AsyncOS | >=13.0<14.2.1 | |
| Cisco Secure Email Gateway | ||
| Cisco AsyncOS | >=12.0<14.2.0 | |
| Cisco Secure Email and Web Manager | ||
| All of | ||
| Cisco AsyncOS | >=13.0<14.2.1 | |
| Cisco Secure Email Gateway | ||
| All of | ||
| Cisco AsyncOS | >=12.0<14.2.0 | |
| Cisco Secure Email and Web Manager |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-20867?
CVE-2022-20867 is a vulnerability in the web-based management interface of the Cisco Email Security Appliance and Cisco Secure Email and Web Manager.
What is the severity of CVE-2022-20867?
The severity of CVE-2022-20867 is medium with a CVSS score of 6.5.
How does CVE-2022-20867 affect Cisco AsyncOS?
CVE-2022-20867 affects Cisco AsyncOS versions between 12.0 and 14.2.0.
How does CVE-2022-20867 affect Cisco Secure Email Gateway?
CVE-2022-20867 does not affect Cisco Secure Email Gateway.
Is there a fix available for CVE-2022-20867?
Yes, Cisco has released software updates to address the vulnerability. Please refer to the Cisco Security Advisory for more information.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/references
- agent/severity
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/cisco
- canonical/cisco asyncos
- version/cisco asyncos/13.0
- canonical/cisco secure email gateway
- version/cisco asyncos/12.0
- canonical/cisco secure email and web manager