CVE-2022-20868

{"id": "CVE-2022-20868", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.2}]}, "published": "2022-11-04T18:15:10.983", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esasmawsa-vulns-YRuSW5mD", "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-321"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance could allow an authenticated, remote attacker to elevate privileges on an affected system. The attacker needs valid credentials to exploit this vulnerability. \r\n\r\nThis vulnerability is due to the use of a hardcoded value to encrypt a token used for certain APIs calls . An attacker could exploit this vulnerability by authenticating to the device and sending a crafted HTTP request. A successful exploit could allow the attacker to impersonate another valid user and execute commands with the privileges of that user account.\r\n"}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz de administraci\u00f3n basada en web de Cisco Email Security Appliance, Cisco Secure Email and Web Manager y Cisco Secure Web Appliance podr\u00eda permitir que un atacante remoto autenticado eleve los privilegios en un sistema afectado. El atacante necesita credenciales v\u00e1lidas para aprovechar esta vulnerabilidad. Esta vulnerabilidad se debe al uso de un valor codificado a mano para cifrar un token utilizado para ciertas llamadas API. Un atacante podr\u00eda aprovechar esta vulnerabilidad autentic\u00e1ndose en el dispositivo y enviando una solicitud HTTP manipulada. Un exploit exitoso podr\u00eda permitir al atacante hacerse pasar por otro usuario v\u00e1lido y ejecutar comandos con los privilegios de esa cuenta de usuario."}], "lastModified": "2024-01-25T17:15:18.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A74DE82-C879-48E3-8E74-F03D18B8ECF4", "versionEndExcluding": "14.2.1", "versionStartIncluding": "13.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:secure_email_gateway:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AEFF3E86-0ED8-40CA-BD69-9FD67F32A31A"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EACCC821-A995-43A9-9BA2-8A335A55FC99", "versionEndExcluding": "14.2.0", "versionStartIncluding": "12.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DB4207E0-A5C1-4945-B996-722933148C37"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68AEA203-411D-40C8-AA2A-A0FB4D2789DB", "versionEndExcluding": "12.5.5", "versionStartIncluding": "11.8"}, {"criteria": "cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE2447D4-9F35-4D76-BF77-F4E63DB57DA1", "versionEndExcluding": "14.0.4", "versionStartIncluding": "14.0"}, {"criteria": "cpe:2.3:o:cisco:asyncos:14.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2FFF4B58-3DAF-47D7-8569-5D3D27F14D22"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:secure_web_appliance:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "67074526-9933-46B3-9FE3-A0BE73C5E8A7"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}