A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack.
This vulnerability is due to the failure of the application or its environment to properly sanitize input values. An attacker could exploit this vulnerability by injecting malicious HTTP headers, controlling the response body, or splitting the response into multiple responses.
References
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
History
21 Nov 2024, 06:43
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ESA-HTTP-Inject-nvsycUmR - | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.7 |
25 Jan 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
07 Nov 2023, 03:42
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This vulnerability is due to the failure of the application or its environment to properly sanitize input values. An attacker could exploit this vulnerability by injecting malicious HTTP headers, controlling the response body, or splitting the response into multiple responses. |
Information
Published : 2022-11-04 18:15
Updated : 2024-11-21 06:43
NVD link : CVE-2022-20772
Mitre link : CVE-2022-20772
CVE.ORG link : CVE-2022-20772
JSON object : View
Products Affected
cisco
- email_security_appliance
- email_security_appliance_firmware
- secure_email_and_web_manager
- secure_email_and_web_manager_firmware