Vulnerabilities fixed in Cisco ESA, SWA and Secure Email and Web Manager

🗓️ 03 Nov 2022 00:00:00Reported by NCSCType

Cisco fixes flaws in Email Security Appliance, Secure Web Appliance, and Email and Web Manager; DoS may be unauthenticated; code and data access require authentication; keep management interface private.

Reporter	Title	Published	Views	Family All 66
BDU FSTEC	The vulnerability in the web interface for managing the Cisco AsyncOS operating system of the Cisco Email Security Appliance (ESA) security email system, the Cisco Secure Email and Web Manager content protection device, and the Cisco Secure Web Appliance (formerly Cisco Web Security Appliance (WSA)) web gateway allows a perpetrator to enhance their privileges.	15 Nov 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability in the web interface for controlling the Cisco AsyncOS operating system of the Cisco Email Security Appliance, as well as in the Cisco Secure Email and Web Manager, allows a perpetrator to execute arbitrary SQL queries.	15 Nov 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Cisco Email Security Appliance’s security system and the Cisco Secure Email and Web Manager, related to the failure to handle CRLF sequences in HTTP headers, allows attackers to perform attacks by splitting HTTP responses.	15 Nov 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability in the web interface for managing the Cisco AsyncOS operating system of the Cisco Email Security Appliance (ESA) security email system, the Cisco Secure Email and Web Manager content protection device, and the Cisco Secure Web Appliance (formerly Cisco Web Security Appliance (WSA)) web gateway allows a perpetrator to expose protected information.	21 Nov 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Cisco AsyncOS operating system in the Cisco Email Security Appliance (ESA) security system allows a perpetrator to trigger a service failure.	21 Nov 202200:00	–	bdu_fstec
Circl	CVE-2022-20867	7 Nov 202213:16	–	circl
Circl	CVE-2022-20868	7 Nov 202213:16	–	circl
Cisco	Cisco Email Security Appliance, Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance Information Disclosure Vulnerability	2 Nov 202216:00	–	cisco
Cisco	Cisco Email Security Appliance Denial of Service Vulnerability	2 Nov 202216:00	–	cisco
Cisco	Cisco Email Security Appliance and Cisco Secure Email and Web Manager HTTP Response Header Injection Vulnerability	2 Nov 202216:00	–	cisco

03 Nov 2022 00:00Current

7.6High risk

Vulners AI Score7.6

CVSS 3.17.5 - 8.8

EPSS0.00891

SSVC