CVE-2022-20772

cisco email security appliance firmware, cisco secure email and web manager firmware

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2022-20772

Katalog CVE

CVSS 5.3 · Medium EPSS 0,60%

Kerentanan Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') pada cisco email security appliance firmware, cisco secure email and web manager firmware. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This vulnerability is due to the failure of the application or its environment to properly sanitize input values. An attacker could exploit this vulnerability by injecting malicious HTTP headers, controlling the response body, or splitting the response into multiple responses.

Rincian

Terbit di NVD
4 November 2022
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
EPSS (30 hari)
0,60% peluang dieksploitasi; lebih tinggi dari 47,4% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
cisco email security appliance firmware Versi 13.5.1 hingga sebelum 14.0.3-015
cisco email security appliance firmware Versi 14.1 hingga sebelum 14.2.1-015
cisco email security appliance firmware Versi 14.3 hingga sebelum 14.3.0-023
cisco secure email and web manager firmware Versi 14.2 hingga sebelum 14.2.0-217
cisco secure email and web manager firmware Versi 14.3 hingga sebelum 14.3.0-115

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.