6.5
Medium
CVE-2022-20942 A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and…
Description
A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance, formerly known as Cisco Web Security Appliance (WSA), could allow an authenticated, remote attacker to retrieve sensitive information from an affected device, including user credentials. This vulnerability is due to weak enforcement of back-end authorization checks. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain confidential data that is stored on the affected device.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cisco Secure Web Appliance 12.5 | 12.5.1-011 → 12.5.2-007 | No fix stated |
| Cisco Secure Web Appliance 12.0 | 12.0.1-268 → 12.0.3-007 | No fix stated |
| Cisco Secure Web Appliance 11.8 | 11.8.0-414 → 11.8.3-021 | No fix stated |
| Cisco Secure Web Appliance 11.7 | 11.7.0-406 → 11.7.2-011 | No fix stated |
| Cisco Secure Email | 14.2.0-620 | No fix stated |
| Cisco Secure Email | 14.0.0-698 | No fix stated |
| Cisco Secure Email | 13.5.1-277 | No fix stated |
| Cisco Secure Email | 13.0.0-392 | No fix stated |
| Cisco Secure Email | 12.5.0-066 | No fix stated |
Show the 15 other branches Hide the 15 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Cisco Secure Email 12.1 | 12.1.0-071 → 12.1.0-089 | No fix stated |
| Cisco Secure Email | 12.0.0-419 | No fix stated |
| Cisco Secure Email 11.1 | 11.1.0-069 → 11.1.0-131 | No fix stated |
| Cisco Secure Email | 11.0.3-238 | No fix stated |
| Cisco Secure Email and Web Manager | 14.2.0-212 | No fix stated |
| Cisco Secure Email and Web Manager 14.1 | 14.1.0-223 → 14.1.0-227 | No fix stated |
| Cisco Secure Email and Web Manager | 14.0.0-404 | No fix stated |
| Cisco Secure Email and Web Manager 13.8 | 13.8.1-068 → 13.8.1-074 | No fix stated |
| Cisco Secure Email and Web Manager | 13.6.2-078 | No fix stated |
| Cisco Secure Email and Web Manager | 13.0.0-277 | No fix stated |
| Cisco Secure Email and Web Manager | 12.8.1-002 | No fix stated |
| Cisco Secure Email and Web Manager 12.5 | 12.5.0-636 → 12.5.0-678 | No fix stated |
| Cisco Secure Email and Web Manager 12.0 | 12.0.0-452 → 12.0.1-011 | No fix stated |
| Cisco Secure Email and Web Manager | 11.5.1-105 | No fix stated |
| Cisco Secure Email and Web Manager 11.0 | 11.0.0-115 → 11.0.1-161 | No fix stated |
References
- cisco-sa-cnt-sec-infodiscl-BVKKnUG sec.cloudapps.cisco.com
Timeline
- Published
- Last modified
Other CVEs of Cisco Secure Web Appliance
The 15 CVEs of Cisco Secure Web Appliance →
CVE-2026-20152
A vulnerability in the authentication service feature of Cisco AsyncOS Software for Cisco Secure Web Appliance could…
5.3
Medium
CVE-2026-20056
A vulnerability in the Dynamic Vectoring and Streaming (DVS) Engine implementation of Cisco AsyncOS Software for Cisco…
4.0
Medium
CVE-2025-20207
A vulnerability in Simple Network Management Protocol (SNMP) polling for Cisco Secure Email and Web Manager, Cisco…
4.3
Medium
CVE-2025-20185
A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure…
3.4
Low