Search
Find a vulnerability
Search criteria
8 vulnerabilities found for Secure Email and Web Manager by Cisco
CERTFR-2026-AVI-1175
Vulnerability from certfr_avis - Published: 2026-09-15 - Updated: 2026-09-17
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une injection SQL (SQLi).
Cisco indique que la vulnérabilité CVE-2026-76461 est activement exploitée.
Indicateurs de compromission
Cisco recommande de rechercher des requêtes SQL suspectes dans les journaux mail_logs.
A ce titre, l'éditeur fournit un exemple, non-exhaustif, de commande :
cisco-esa> grep -i "COPY.*TO PROGRAM" [IronPort Text Mail Logs Log name - Default: mail_logs]
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | Secure Email and Web Manager | Secure Email and Web Manager versions antérieures à 15.5.5-006 | ||
| Cisco | AsyncOS | AsyncOS pour Secure Email Gateway versions 16.5.x antérieures à 16.5.0-780 | ||
| Cisco | Secure Email and Web Manager | Secure Email and Web Manager versions 16.x antérieures à 16.5.0-429 | ||
| Cisco | Secure Email Gateway | Secure Email Gateway versions 16.x antérieures à 16.5.0-780 | ||
| Cisco | AsyncOS | AsyncOS pour Secure Email Gateway versions 16.0.x antérieures à 16.0.4-3021 | ||
| Cisco | AsyncOS | AsyncOS pour Secure Email Gateway versions antérieures à 15.5.5-0141 | ||
| Cisco | Secure Email Gateway | Secure Email Gateway versions antérieures à 15.5.5-014 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Secure Email and Web Manager versions ant\u00e9rieures \u00e0 15.5.5-006",
"product": {
"name": "Secure Email and Web Manager",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "AsyncOS pour Secure Email Gateway versions 16.5.x ant\u00e9rieures \u00e0 16.5.0-780",
"product": {
"name": "AsyncOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Secure Email and Web Manager versions 16.x ant\u00e9rieures \u00e0 16.5.0-429",
"product": {
"name": "Secure Email and Web Manager",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Secure Email Gateway versions 16.x ant\u00e9rieures \u00e0 16.5.0-780",
"product": {
"name": "Secure Email Gateway",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "AsyncOS pour Secure Email Gateway versions 16.0.x ant\u00e9rieures \u00e0 16.0.4-3021",
"product": {
"name": "AsyncOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "AsyncOS pour Secure Email Gateway versions ant\u00e9rieures \u00e0 15.5.5-0141",
"product": {
"name": "AsyncOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Secure Email Gateway versions ant\u00e9rieures \u00e0 15.5.5-014",
"product": {
"name": "Secure Email Gateway",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-76461",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76461"
},
{
"name": "CVE-2026-76440",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76440"
},
{
"name": "CVE-2026-76441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76441"
},
{
"name": "CVE-2026-76443",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76443"
},
{
"name": "CVE-2026-20353",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20353"
},
{
"name": "CVE-2026-76442",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76442"
}
],
"initial_release_date": "2026-09-15T00:00:00",
"last_revision_date": "2026-09-17T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1175",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-15T00:00:00.000000"
},
{
"description": "Ajout de la section Indicateurs de compromission.",
"revision_date": "2026-09-17T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Injection SQL (SQLi)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une injection SQL (SQLi).\n\nCisco indique que la vuln\u00e9rabilit\u00e9 CVE-2026-76461 est activement exploit\u00e9e.\n\n## Indicateurs de compromission\n\nCisco recommande de rechercher des requ\u00eates SQL suspectes dans les journaux *mail_logs*. \u003cbr\u003e\nA ce titre, l\u0027\u00e9diteur fournit un exemple, non-exhaustif, de commande :\u003cbr\u003e\n\u003ccode\u003ecisco-esa\u003e grep -i \"COPY.*TO PROGRAM\" [IronPort Text Mail Logs Log name - Default: mail_logs]\u003c/code\u003e",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-esa-inj-2bLVGmhX",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX"
},
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-hardening-esa-dfCrfXkm",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm"
}
]
}
VAR-202206-1254
Vulnerability from variot - Updated: 2024-11-23 22:50A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly known as Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass authentication and log in to the web management interface of an affected device. This vulnerability is due to improper authentication checks when an affected device uses Lightweight Directory Access Protocol (LDAP) for external authentication. An attacker could exploit this vulnerability by entering a specific input on the login page of the affected device. A successful exploit could allow the attacker to gain unauthorized access to the web-based management interface of the affected device. (DoS) It may be in a state
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202206-1254",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "email security appliance",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0"
},
{
"model": "secure email and web manager",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "13.0"
},
{
"model": "secure email and web manager",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "14.1"
},
{
"model": "secure email and web manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "14.1.0-250"
},
{
"model": "secure email and web manager",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "13.6"
},
{
"model": "secure email and web manager",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0"
},
{
"model": "secure email and web manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.0-418"
},
{
"model": "secure email and web manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "13.8.1-090"
},
{
"model": "secure email and web manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "13.6.2-090"
},
{
"model": "secure email and web manager",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "13.8"
},
{
"model": "email security appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "7.1.5"
},
{
"model": "email security appliance",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.1-033"
},
{
"model": "secure email and web manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "13.0.0-277"
},
{
"model": "cisco email security appliance",
"scope": null,
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": null
},
{
"model": "cisco secure email and web manager",
"scope": null,
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-011606"
},
{
"db": "NVD",
"id": "CVE-2022-20798"
}
]
},
"cve": "CVE-2022-20798",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2022-20798",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-405351",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2022-20798",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2022-20798",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2022-20798",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "ykramarz@cisco.com",
"id": "CVE-2022-20798",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2022-20798",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNNVD",
"id": "CNNVD-202206-1535",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-405351",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2022-20798",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-405351"
},
{
"db": "VULMON",
"id": "CVE-2022-20798"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011606"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1535"
},
{
"db": "NVD",
"id": "CVE-2022-20798"
},
{
"db": "NVD",
"id": "CVE-2022-20798"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly known as Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass authentication and log in to the web management interface of an affected device. This vulnerability is due to improper authentication checks when an affected device uses Lightweight Directory Access Protocol (LDAP) for external authentication. An attacker could exploit this vulnerability by entering a specific input on the login page of the affected device. A successful exploit could allow the attacker to gain unauthorized access to the web-based management interface of the affected device. (DoS) It may be in a state",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-20798"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011606"
},
{
"db": "VULHUB",
"id": "VHN-405351"
},
{
"db": "VULMON",
"id": "CVE-2022-20798"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-20798",
"trust": 3.4
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011606",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1535",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2022.2965",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2022-55685",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-405351",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2022-20798",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-405351"
},
{
"db": "VULMON",
"id": "CVE-2022-20798"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011606"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1535"
},
{
"db": "NVD",
"id": "CVE-2022-20798"
}
]
},
"id": "VAR-202206-1254",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-405351"
}
],
"trust": 0.53892258
},
"last_update_date": "2024-11-23T22:50:46.500000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "cisco-sa-sma-esa-auth-bypass-66kEcxQD",
"trust": 0.8,
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-esa-auth-bypass-66kEcxQD"
},
{
"title": "Cisco Multiple products Remediation measures for authorization problem vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=198123"
},
{
"title": "Cisco: Cisco Email Security Appliance and Cisco Secure Email and Web Manager External Authentication Bypass Vulnerability",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=cisco-sa-sma-esa-auth-bypass-66kEcxQD"
},
{
"title": "CVE-2022-XXXX",
"trust": 0.1,
"url": "https://github.com/AlphabugX/CVE-2022-23305 "
},
{
"title": "CVE-2022-XXXX",
"trust": 0.1,
"url": "https://github.com/AlphabugX/CVE-2022-RCE "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2022-20798"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011606"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1535"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-287",
"trust": 1.1
},
{
"problemtype": "Inappropriate authentication (CWE-287) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-405351"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011606"
},
{
"db": "NVD",
"id": "CVE-2022-20798"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-sma-esa-auth-bypass-66kecxqd"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-20798"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.2965"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/cisco-esa-secure-email-and-web-manager-privilege-escalation-via-ldap-external-authentication-38604"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-20798/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/287.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/alphabugx/cve-2022-23305"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-405351"
},
{
"db": "VULMON",
"id": "CVE-2022-20798"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011606"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1535"
},
{
"db": "NVD",
"id": "CVE-2022-20798"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-405351"
},
{
"db": "VULMON",
"id": "CVE-2022-20798"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011606"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1535"
},
{
"db": "NVD",
"id": "CVE-2022-20798"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-06-15T00:00:00",
"db": "VULHUB",
"id": "VHN-405351"
},
{
"date": "2022-06-15T00:00:00",
"db": "VULMON",
"id": "CVE-2022-20798"
},
{
"date": "2023-08-23T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-011606"
},
{
"date": "2022-06-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202206-1535"
},
{
"date": "2022-06-15T18:15:08.927000",
"db": "NVD",
"id": "CVE-2022-20798"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-06-27T00:00:00",
"db": "VULHUB",
"id": "VHN-405351"
},
{
"date": "2023-11-07T00:00:00",
"db": "VULMON",
"id": "CVE-2022-20798"
},
{
"date": "2023-08-23T05:10:00",
"db": "JVNDB",
"id": "JVNDB-2022-011606"
},
{
"date": "2022-06-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202206-1535"
},
{
"date": "2024-11-21T06:43:34.657000",
"db": "NVD",
"id": "CVE-2022-20798"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202206-1535"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco\u00a0Secure\u00a0Email\u00a0and\u00a0Web\u00a0Manager\u00a0 and \u00a0Cisco\u00a0Email\u00a0Security\u00a0Appliance\u00a0 Authentication vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-011606"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "authorization issue",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202206-1535"
}
],
"trust": 0.6
}
}
VAR-202206-1349
Vulnerability from variot - Updated: 2024-11-23 22:32A vulnerability in the web management interface of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance (ESA) could allow an authenticated, remote attacker to retrieve sensitive information from a Lightweight Directory Access Protocol (LDAP) external authentication server connected to an affected device. This vulnerability is due to a lack of proper input sanitization while querying the external authentication server. An attacker could exploit this vulnerability by sending a crafted query through an external authentication web page. A successful exploit could allow the attacker to gain access to sensitive information, including user credentials from the external authentication server. To exploit this vulnerability, an attacker would need valid operator-level (or higher) credentials
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202206-1349",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "secure email and web manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "13.6.2-090"
},
{
"model": "secure email and web manager",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "14.1"
},
{
"model": "email security appliance",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.2-020"
},
{
"model": "secure email and web manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "14.1.0-227"
},
{
"model": "cisco email security appliance",
"scope": null,
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": null
},
{
"model": "cisco secure email and web manager",
"scope": null,
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-011609"
},
{
"db": "NVD",
"id": "CVE-2022-20664"
}
]
},
"cve": "CVE-2022-20664",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.8,
"id": "CVE-2022-20664",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 1.9,
"vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.8,
"id": "VHN-405217",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:S/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.1,
"id": "CVE-2022-20664",
"impactScore": 4.0,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"trust": 2.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 7.7,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2022-20664",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "Low",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2022-20664",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "ykramarz@cisco.com",
"id": "CVE-2022-20664",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2022-20664",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-202206-1538",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-405217",
"trust": 0.1,
"value": "LOW"
},
{
"author": "VULMON",
"id": "CVE-2022-20664",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-405217"
},
{
"db": "VULMON",
"id": "CVE-2022-20664"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011609"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1538"
},
{
"db": "NVD",
"id": "CVE-2022-20664"
},
{
"db": "NVD",
"id": "CVE-2022-20664"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability in the web management interface of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance (ESA) could allow an authenticated, remote attacker to retrieve sensitive information from a Lightweight Directory Access Protocol (LDAP) external authentication server connected to an affected device. This vulnerability is due to a lack of proper input sanitization while querying the external authentication server. An attacker could exploit this vulnerability by sending a crafted query through an external authentication web page. A successful exploit could allow the attacker to gain access to sensitive information, including user credentials from the external authentication server. To exploit this vulnerability, an attacker would need valid operator-level (or higher) credentials",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-20664"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011609"
},
{
"db": "VULHUB",
"id": "VHN-405217"
},
{
"db": "VULMON",
"id": "CVE-2022-20664"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-20664",
"trust": 3.4
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011609",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1538",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2022.2968",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2022-55669",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-405217",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2022-20664",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-405217"
},
{
"db": "VULMON",
"id": "CVE-2022-20664"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011609"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1538"
},
{
"db": "NVD",
"id": "CVE-2022-20664"
}
]
},
"id": "VAR-202206-1349",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-405217"
}
],
"trust": 0.53892258
},
"last_update_date": "2024-11-23T22:32:46.399000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "cisco-sa-esasma-info-dsc-Q9tLuOvM",
"trust": 0.8,
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esasma-info-dsc-Q9tLuOvM"
},
{
"title": "Cisco Multiple products Repair measures for information disclosure vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=198125"
},
{
"title": "Cisco: Cisco Email Security Appliance and Cisco Secure Email and Web Manager Information Disclosure Vulnerability",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=cisco-sa-esasma-info-dsc-Q9tLuOvM"
},
{
"title": "CVE-2022-XXXX",
"trust": 0.1,
"url": "https://github.com/AlphabugX/CVE-2022-23305 "
},
{
"title": "CVE-2022-XXXX",
"trust": 0.1,
"url": "https://github.com/AlphabugX/CVE-2022-RCE "
},
{
"title": "The Register",
"trust": 0.1,
"url": "https://www.theregister.co.uk/2022/06/22/cisco_bug_bundle/"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2022-20664"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011609"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1538"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.1
},
{
"problemtype": "CWE-497",
"trust": 1.0
},
{
"problemtype": "information leak (CWE-200) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-405217"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011609"
},
{
"db": "NVD",
"id": "CVE-2022-20664"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-esasma-info-dsc-q9tluovm"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-20664"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/cisco-esa-secure-email-and-web-manager-information-disclosure-via-ldap-38605"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.2968"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-20664/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/200.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/alphabugx/cve-2022-23305"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-405217"
},
{
"db": "VULMON",
"id": "CVE-2022-20664"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011609"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1538"
},
{
"db": "NVD",
"id": "CVE-2022-20664"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-405217"
},
{
"db": "VULMON",
"id": "CVE-2022-20664"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011609"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1538"
},
{
"db": "NVD",
"id": "CVE-2022-20664"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-06-15T00:00:00",
"db": "VULHUB",
"id": "VHN-405217"
},
{
"date": "2022-06-15T00:00:00",
"db": "VULMON",
"id": "CVE-2022-20664"
},
{
"date": "2023-08-23T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-011609"
},
{
"date": "2022-06-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202206-1538"
},
{
"date": "2022-06-15T18:15:08.690000",
"db": "NVD",
"id": "CVE-2022-20664"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-06-27T00:00:00",
"db": "VULHUB",
"id": "VHN-405217"
},
{
"date": "2023-11-07T00:00:00",
"db": "VULMON",
"id": "CVE-2022-20664"
},
{
"date": "2023-08-23T05:21:00",
"db": "JVNDB",
"id": "JVNDB-2022-011609"
},
{
"date": "2022-07-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202206-1538"
},
{
"date": "2024-11-21T06:43:16.190000",
"db": "NVD",
"id": "CVE-2022-20664"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202206-1538"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco\u00a0Secure\u00a0Email\u00a0and\u00a0Web\u00a0Manager\u00a0 and \u00a0Cisco\u00a0Email\u00a0Security\u00a0Appliance\u00a0 Vulnerability regarding information leakage in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-011609"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202206-1538"
}
],
"trust": 0.6
}
}
VAR-202211-0266
Vulnerability from variot - Updated: 2024-08-14 15:42A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack.
This vulnerability is due to the failure of the application or its environment to properly sanitize input values. An attacker could exploit this vulnerability by injecting malicious HTTP headers, controlling the response body, or splitting the response into multiple responses
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202211-0266",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "email security appliance",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "14.3"
},
{
"model": "email security appliance",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.3-015"
},
{
"model": "email security appliance",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "14.3.0-023"
},
{
"model": "secure email and web manager",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "14.2"
},
{
"model": "secure email and web manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "14.2.0-217"
},
{
"model": "email security appliance",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "14.2.1-015"
},
{
"model": "secure email and web manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "14.3.0-115"
},
{
"model": "email security appliance",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "14.1"
},
{
"model": "email security appliance",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "13.5.1"
},
{
"model": "secure email and web manager",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "14.3"
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "14.3 that\u0027s all 14.3.0-115"
},
{
"model": "cisco e \u30e1\u30fc\u30eb \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30a2\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9",
"scope": null,
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": null
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "14.2 that\u0027s all 14.2.0-217"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-022865"
},
{
"db": "NVD",
"id": "CVE-2022-20772"
}
]
},
"cve": "CVE-2022-20772",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2022-20772",
"impactScore": 1.4,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "ykramarz@cisco.com",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 2.8,
"id": "CVE-2022-20772",
"impactScore": 1.4,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.3,
"baseSeverity": "Medium",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2022-20772",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2022-20772",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "ykramarz@cisco.com",
"id": "CVE-2022-20772",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2022-20772",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-202211-1945",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-022865"
},
{
"db": "CNNVD",
"id": "CNNVD-202211-1945"
},
{
"db": "NVD",
"id": "CVE-2022-20772"
},
{
"db": "NVD",
"id": "CVE-2022-20772"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. \r\n\r This vulnerability is due to the failure of the application or its environment to properly sanitize input values. An attacker could exploit this vulnerability by injecting malicious HTTP headers, controlling the response body, or splitting the response into multiple responses",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-20772"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-022865"
}
],
"trust": 1.62
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-20772",
"trust": 3.2
},
{
"db": "JVNDB",
"id": "JVNDB-2022-022865",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202211-1945",
"trust": 0.6
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-022865"
},
{
"db": "CNNVD",
"id": "CNNVD-202211-1945"
},
{
"db": "NVD",
"id": "CVE-2022-20772"
}
]
},
"id": "VAR-202211-0266",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.43892258
},
"last_update_date": "2024-08-14T15:42:10.885000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "cisco-sa-ESA-HTTP-Inject-nvsycUmR",
"trust": 0.8,
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ESA-HTTP-Inject-nvsycUmR"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-022865"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-113",
"trust": 1.0
},
{
"problemtype": "CWE-74",
"trust": 1.0
},
{
"problemtype": "injection (CWE-74) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-022865"
},
{
"db": "NVD",
"id": "CVE-2022-20772"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.0,
"url": "https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-esa-http-inject-nvsycumr"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-20772"
},
{
"trust": 0.6,
"url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-esa-http-inject-nvsycumr"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/cisco-esa-sewm-header-injection-39814"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-20772/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-022865"
},
{
"db": "CNNVD",
"id": "CNNVD-202211-1945"
},
{
"db": "NVD",
"id": "CVE-2022-20772"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2022-022865"
},
{
"db": "CNNVD",
"id": "CNNVD-202211-1945"
},
{
"db": "NVD",
"id": "CVE-2022-20772"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-11-21T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-022865"
},
{
"date": "2022-11-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202211-1945"
},
{
"date": "2022-11-04T18:15:10.843000",
"db": "NVD",
"id": "CVE-2022-20772"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-11-21T02:48:00",
"db": "JVNDB",
"id": "JVNDB-2022-022865"
},
{
"date": "2022-11-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202211-1945"
},
{
"date": "2024-01-25T17:15:15.223000",
"db": "NVD",
"id": "CVE-2022-20772"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202211-1945"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco Systems \u00a0Cisco\u00a0E\u00a0 Email \u00a0 Security \u00a0 appliance firmware and \u00a0Cisco\u00a0Secure\u00a0Email\u00a0and\u00a0Web\u00a0Manager\u00a0 Injection vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-022865"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202211-1945"
}
],
"trust": 0.6
}
}
VAR-202306-1941
Vulnerability from variot - Updated: 2024-08-14 15:41A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, formerly known as Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link:sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-xss-cP9DuEmq Attention: Simplifying the Cisco portfolio includes the renaming of security products under one brand: Cisco Secure
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202306-1941",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "secure email gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "15.0.0-256"
},
{
"model": "web security appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.1-033"
},
{
"model": "secure email gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.1-033"
},
{
"model": "web security appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.1-053"
},
{
"model": "secure email and web manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "15.0.0-256"
},
{
"model": "web security appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "15.0.0-050"
},
{
"model": "secure email and web manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.1-033"
},
{
"model": "web security appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.0-418"
},
{
"model": "secure email gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.1-053"
},
{
"model": "secure email and web manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.1-053"
},
{
"model": "secure email gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.0-418"
},
{
"model": "secure email gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "15.0.0-050"
},
{
"model": "web security appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "15.0.0-256"
},
{
"model": "secure email and web manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "15.0.0-050"
},
{
"model": "secure email and web manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.0-418"
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "15.0.0-050"
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "14.0.1-033"
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "14.0.1-053"
},
{
"model": "cisco secure email gateway",
"scope": null,
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": null
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "15.0.0-256"
},
{
"model": "cisco web \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30a2\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9 \u30bd\u30d5\u30c8\u30a6\u30a7\u30a2",
"scope": null,
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": null
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "14.0.0-418"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-024108"
},
{
"db": "NVD",
"id": "CVE-2023-20119"
}
]
},
"cve": "CVE-2023-20119",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.8,
"id": "CVE-2023-20119",
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 2.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 6.1,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "CVE-2023-20119",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "None",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2023-20119",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "ykramarz@cisco.com",
"id": "CVE-2023-20119",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2023-20119",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-202306-2001",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-024108"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-2001"
},
{
"db": "NVD",
"id": "CVE-2023-20119"
},
{
"db": "NVD",
"id": "CVE-2023-20119"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, formerly known as Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. \r\n\r This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. \nFor more information about these vulnerabilities, see the Details section of this advisory. \nCisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. \nThis advisory is available at the following link:sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-xss-cP9DuEmq\nAttention: Simplifying the Cisco portfolio includes the renaming of security products under one brand: Cisco Secure",
"sources": [
{
"db": "NVD",
"id": "CVE-2023-20119"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-024108"
},
{
"db": "VULMON",
"id": "CVE-2023-20119"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2023-20119",
"trust": 3.3
},
{
"db": "JVNDB",
"id": "JVNDB-2023-024108",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202306-2001",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2023-20119",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-20119"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-024108"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-2001"
},
{
"db": "NVD",
"id": "CVE-2023-20119"
}
]
},
"id": "VAR-202306-1941",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.45906568
},
"last_update_date": "2024-08-14T15:41:42.230000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "cisco-sa-esa-sma-wsa-xss-cP9DuEmq",
"trust": 0.8,
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-xss-cP9DuEmq"
},
{
"title": "Multiple Cisco product Fixes for cross-site scripting vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=244902"
},
{
"title": "Cisco: Cisco Secure Email Gateway, Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance Cross-Site Scripting Vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=cisco-sa-esa-sma-wsa-xss-cP9DuEmq"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-20119"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-024108"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-2001"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.0
},
{
"problemtype": "Cross-site scripting (CWE-79) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-024108"
},
{
"db": "NVD",
"id": "CVE-2023-20119"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-esa-sma-wsa-xss-cp9duemq"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-20119"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2023-20119/"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-20119"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-024108"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-2001"
},
{
"db": "NVD",
"id": "CVE-2023-20119"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULMON",
"id": "CVE-2023-20119"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-024108"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-2001"
},
{
"db": "NVD",
"id": "CVE-2023-20119"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-01-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2023-024108"
},
{
"date": "2023-06-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202306-2001"
},
{
"date": "2023-06-28T15:15:09.700000",
"db": "NVD",
"id": "CVE-2023-20119"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-01-30T06:38:00",
"db": "JVNDB",
"id": "JVNDB-2023-024108"
},
{
"date": "2023-07-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202306-2001"
},
{
"date": "2024-01-25T17:15:31.220000",
"db": "NVD",
"id": "CVE-2023-20119"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202306-2001"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting vulnerability in multiple Cisco Systems products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-024108"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202306-2001"
}
],
"trust": 0.6
}
}
VAR-202302-1598
Vulnerability from variot - Updated: 2024-08-14 15:05A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) could allow an authenticated remote attacker and or authenticated local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential with at least a [[privilege of operator - validate actual name]].
The vulnerability is due to the processing of a specially crafted SNMP configuration file. An attacker could exploit this vulnerability by authenticating to the targeted device and uploading a specially crafted SNMP configuration file that when uploaded could allow for the execution of commands as root. An exploit could allow the attacker to gain root access on the device. Cisco Systems Cisco Email Security Appliance and secure email and web manager Contains a vulnerability related to unlimited uploads of dangerous types of files.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link:sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-privesc-9DVkFpJ8
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202302-1598",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "secure email and web manager",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "13.8.0"
},
{
"model": "secure email and web manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "14.2.0-224"
},
{
"model": "secure email and web manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "12.8.1-021"
},
{
"model": "email security appliance",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "13.5.0"
},
{
"model": "secure email and web manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "13.8.1-108"
},
{
"model": "email security appliance",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "14.2.1-020"
},
{
"model": "email security appliance",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "13.0.0"
},
{
"model": "email security appliance",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "14.3.0"
},
{
"model": "secure email and web manager",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.0"
},
{
"model": "email security appliance",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "13.5.4-038"
},
{
"model": "secure email and web manager",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "14.3.0"
},
{
"model": "email security appliance",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "12.5.3-041"
},
{
"model": "email security appliance",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "13.0.5-007"
},
{
"model": "email security appliance",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.0"
},
{
"model": "secure email and web manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "14.3.0-120"
},
{
"model": "email security appliance",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "14.3.0-032"
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "13.8.0 that\u0027s all 13.8.1-108"
},
{
"model": "cisco email security appliance",
"scope": null,
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": null
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "12.8.1-021"
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "14.3.0 that\u0027s all 14.3.0-120"
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "14.0.0 that\u0027s all 14.2.0-224"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-003790"
},
{
"db": "NVD",
"id": "CVE-2023-20009"
}
]
},
"cve": "CVE-2023-20009",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.2,
"id": "CVE-2023-20009",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "ykramarz@cisco.com",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.2,
"id": "CVE-2023-20009",
"impactScore": 5.2,
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.2,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2023-20009",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "High",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2023-20009",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "ykramarz@cisco.com",
"id": "CVE-2023-20009",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2023-20009",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-202303-044",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-003790"
},
{
"db": "CNNVD",
"id": "CNNVD-202303-044"
},
{
"db": "NVD",
"id": "CVE-2023-20009"
},
{
"db": "NVD",
"id": "CVE-2023-20009"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) could allow an authenticated remote attacker and or authenticated local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential with at least a [[privilege of operator - validate actual name]]. \r\n\r The vulnerability is due to the processing of a specially crafted SNMP configuration file. An attacker could exploit this vulnerability by authenticating to the targeted device and uploading a specially crafted SNMP configuration file that when uploaded could allow for the execution of commands as root. An exploit could allow the attacker to gain root access on the device. Cisco Systems Cisco Email Security Appliance and secure email and web manager Contains a vulnerability related to unlimited uploads of dangerous types of files.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. \nFor more information about these vulnerabilities, see the Details section of this advisory. \nCisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. \nThis advisory is available at the following link:sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-privesc-9DVkFpJ8",
"sources": [
{
"db": "NVD",
"id": "CVE-2023-20009"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-003790"
},
{
"db": "VULMON",
"id": "CVE-2023-20009"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2023-20009",
"trust": 3.3
},
{
"db": "JVNDB",
"id": "JVNDB-2023-003790",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202303-044",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2023-20009",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-20009"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-003790"
},
{
"db": "CNNVD",
"id": "CNNVD-202303-044"
},
{
"db": "NVD",
"id": "CVE-2023-20009"
}
]
},
"id": "VAR-202302-1598",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.43892258
},
"last_update_date": "2024-08-14T15:05:53.426000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "cisco-sa-esa-sma-privesc-9DVkFpJ8",
"trust": 0.8,
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-privesc-9DVkFpJ8"
},
{
"title": "Cisco Secure Email Fixes for code issue vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=228469"
},
{
"title": "Cisco: Cisco Email Security Appliance and Cisco Secure Email and Web Manager Vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=cisco-sa-esa-sma-privesc-9DVkFpJ8"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-20009"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-003790"
},
{
"db": "CNNVD",
"id": "CNNVD-202303-044"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-20",
"trust": 1.0
},
{
"problemtype": "CWE-434",
"trust": 1.0
},
{
"problemtype": "Unlimited uploads of dangerous types of files (CWE-434) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-003790"
},
{
"db": "NVD",
"id": "CVE-2023-20009"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-esa-sma-privesc-9dvkfpj8"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-20009"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2023-20009/"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-20009"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-003790"
},
{
"db": "CNNVD",
"id": "CNNVD-202303-044"
},
{
"db": "NVD",
"id": "CVE-2023-20009"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULMON",
"id": "CVE-2023-20009"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-003790"
},
{
"db": "CNNVD",
"id": "CNNVD-202303-044"
},
{
"db": "NVD",
"id": "CVE-2023-20009"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-10-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2023-003790"
},
{
"date": "2023-03-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202303-044"
},
{
"date": "2023-03-01T08:15:11.767000",
"db": "NVD",
"id": "CVE-2023-20009"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-10-13T01:03:00",
"db": "JVNDB",
"id": "JVNDB-2023-003790"
},
{
"date": "2023-03-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202303-044"
},
{
"date": "2024-01-25T17:15:24.400000",
"db": "NVD",
"id": "CVE-2023-20009"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202303-044"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco Systems \u00a0Cisco\u00a0Email\u00a0Security\u00a0Appliance\u00a0 and \u00a0secure\u00a0email\u00a0and\u00a0web\u00a0manager\u00a0 Vulnerability in unlimited upload of dangerous types of files in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-003790"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "code problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202303-044"
}
],
"trust": 0.6
}
}
VAR-202306-1845
Vulnerability from variot - Updated: 2024-08-14 14:23Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, formerly Cisco Email Security Appliance (ESA); and Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow a remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link:sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-xss-cP9DuEmq Attention: Simplifying the Cisco portfolio includes the renaming of security products under one brand: Cisco Secure
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202306-1845",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "secure email gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "15.0.0-256"
},
{
"model": "web security appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.1-033"
},
{
"model": "secure email gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.1-033"
},
{
"model": "web security appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.1-053"
},
{
"model": "secure email and web manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "15.0.0-256"
},
{
"model": "web security appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "15.0.0-050"
},
{
"model": "secure email and web manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.1-033"
},
{
"model": "web security appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.0-418"
},
{
"model": "secure email gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.1-053"
},
{
"model": "secure email and web manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.1-053"
},
{
"model": "secure email gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.0-418"
},
{
"model": "secure email gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "15.0.0-050"
},
{
"model": "web security appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "15.0.0-256"
},
{
"model": "secure email and web manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "15.0.0-050"
},
{
"model": "secure email and web manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.0-418"
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "15.0.0-050"
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "14.0.1-033"
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "14.0.1-053"
},
{
"model": "cisco secure email gateway",
"scope": null,
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": null
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "15.0.0-256"
},
{
"model": "cisco web \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30a2\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9 \u30bd\u30d5\u30c8\u30a6\u30a7\u30a2",
"scope": null,
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": null
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "14.0.0-418"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-024109"
},
{
"db": "NVD",
"id": "CVE-2023-20120"
}
]
},
"cve": "CVE-2023-20120",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.8,
"id": "CVE-2023-20120",
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "ykramarz@cisco.com",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.3,
"id": "CVE-2023-20120",
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 6.1,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "CVE-2023-20120",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "None",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2023-20120",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "ykramarz@cisco.com",
"id": "CVE-2023-20120",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2023-20120",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-202306-2003",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-024109"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-2003"
},
{
"db": "NVD",
"id": "CVE-2023-20120"
},
{
"db": "NVD",
"id": "CVE-2023-20120"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, formerly Cisco Email Security Appliance (ESA); and Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow a remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities, see the Details section of this advisory. \nCisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. \nThis advisory is available at the following link:sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-xss-cP9DuEmq\nAttention: Simplifying the Cisco portfolio includes the renaming of security products under one brand: Cisco Secure",
"sources": [
{
"db": "NVD",
"id": "CVE-2023-20120"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-024109"
},
{
"db": "VULMON",
"id": "CVE-2023-20120"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2023-20120",
"trust": 3.3
},
{
"db": "JVNDB",
"id": "JVNDB-2023-024109",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202306-2003",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2023-20120",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-20120"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-024109"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-2003"
},
{
"db": "NVD",
"id": "CVE-2023-20120"
}
]
},
"id": "VAR-202306-1845",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.45906568
},
"last_update_date": "2024-08-14T14:23:58.289000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "cisco-sa-esa-sma-wsa-xss-cP9DuEmq",
"trust": 0.8,
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-xss-cP9DuEmq"
},
{
"title": "Multiple Cisco product Fixes for cross-site scripting vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=244904"
},
{
"title": "Cisco: Cisco Secure Email Gateway, Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance Cross-Site Scripting Vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=cisco-sa-esa-sma-wsa-xss-cP9DuEmq"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-20120"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-024109"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-2003"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.0
},
{
"problemtype": "Cross-site scripting (CWE-79) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-024109"
},
{
"db": "NVD",
"id": "CVE-2023-20120"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-esa-sma-wsa-xss-cp9duemq"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-20120"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2023-20120/"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-20120"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-024109"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-2003"
},
{
"db": "NVD",
"id": "CVE-2023-20120"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULMON",
"id": "CVE-2023-20120"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-024109"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-2003"
},
{
"db": "NVD",
"id": "CVE-2023-20120"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-01-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2023-024109"
},
{
"date": "2023-06-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202306-2003"
},
{
"date": "2023-06-28T15:15:09.760000",
"db": "NVD",
"id": "CVE-2023-20120"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-01-30T06:38:00",
"db": "JVNDB",
"id": "JVNDB-2023-024109"
},
{
"date": "2023-07-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202306-2003"
},
{
"date": "2023-11-07T04:06:06.050000",
"db": "NVD",
"id": "CVE-2023-20120"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202306-2003"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting vulnerability in multiple Cisco Systems products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-024109"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202306-2003"
}
],
"trust": 0.6
}
}
VAR-202306-2182
Vulnerability from variot - Updated: 2024-08-14 14:17Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, formerly Cisco Email Security Appliance (ESA); and Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow a remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link:sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-xss-cP9DuEmq Attention: Simplifying the Cisco portfolio includes the renaming of security products under one brand: Cisco Secure
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202306-2182",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "secure email gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "15.0.0-256"
},
{
"model": "web security appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.1-033"
},
{
"model": "secure email gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.1-033"
},
{
"model": "web security appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.1-053"
},
{
"model": "secure email and web manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "15.0.0-256"
},
{
"model": "web security appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "15.0.0-050"
},
{
"model": "secure email and web manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.1-033"
},
{
"model": "web security appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.0-418"
},
{
"model": "secure email gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.1-053"
},
{
"model": "secure email and web manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.1-053"
},
{
"model": "secure email gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.0-418"
},
{
"model": "secure email gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "15.0.0-050"
},
{
"model": "web security appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "15.0.0-256"
},
{
"model": "secure email and web manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "15.0.0-050"
},
{
"model": "secure email and web manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0.0-418"
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "15.0.0-050"
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "14.0.1-033"
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "14.0.1-053"
},
{
"model": "cisco secure email gateway",
"scope": null,
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": null
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "15.0.0-256"
},
{
"model": "cisco web \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30a2\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9 \u30bd\u30d5\u30c8\u30a6\u30a7\u30a2",
"scope": null,
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": null
},
{
"model": "cisco secure email and web manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": "14.0.0-418"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-024105"
},
{
"db": "NVD",
"id": "CVE-2023-20028"
}
]
},
"cve": "CVE-2023-20028",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.3,
"id": "CVE-2023-20028",
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"trust": 2.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.4,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "CVE-2023-20028",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "Low",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2023-20028",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "ykramarz@cisco.com",
"id": "CVE-2023-20028",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2023-20028",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-202306-2002",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-024105"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-2002"
},
{
"db": "NVD",
"id": "CVE-2023-20028"
},
{
"db": "NVD",
"id": "CVE-2023-20028"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, formerly Cisco Email Security Appliance (ESA); and Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow a remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities, see the Details section of this advisory. \nCisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. \nThis advisory is available at the following link:sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-xss-cP9DuEmq\nAttention: Simplifying the Cisco portfolio includes the renaming of security products under one brand: Cisco Secure",
"sources": [
{
"db": "NVD",
"id": "CVE-2023-20028"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-024105"
},
{
"db": "VULMON",
"id": "CVE-2023-20028"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2023-20028",
"trust": 3.3
},
{
"db": "JVNDB",
"id": "JVNDB-2023-024105",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202306-2002",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2023-20028",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-20028"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-024105"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-2002"
},
{
"db": "NVD",
"id": "CVE-2023-20028"
}
]
},
"id": "VAR-202306-2182",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.45906568
},
"last_update_date": "2024-08-14T14:17:08.162000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "cisco-sa-esa-sma-wsa-xss-cP9DuEmq",
"trust": 0.8,
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-xss-cP9DuEmq"
},
{
"title": "Multiple Cisco product Fixes for cross-site scripting vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=244903"
},
{
"title": "Cisco: Cisco Secure Email Gateway, Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance Cross-Site Scripting Vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=cisco-sa-esa-sma-wsa-xss-cP9DuEmq"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-20028"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-024105"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-2002"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.0
},
{
"problemtype": "Cross-site scripting (CWE-79) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-024105"
},
{
"db": "NVD",
"id": "CVE-2023-20028"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-esa-sma-wsa-xss-cp9duemq"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-20028"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2023-20028/"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-20028"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-024105"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-2002"
},
{
"db": "NVD",
"id": "CVE-2023-20028"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULMON",
"id": "CVE-2023-20028"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-024105"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-2002"
},
{
"db": "NVD",
"id": "CVE-2023-20028"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-01-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2023-024105"
},
{
"date": "2023-06-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202306-2002"
},
{
"date": "2023-06-28T15:15:09.457000",
"db": "NVD",
"id": "CVE-2023-20028"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-01-30T06:37:00",
"db": "JVNDB",
"id": "JVNDB-2023-024105"
},
{
"date": "2023-07-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202306-2002"
},
{
"date": "2023-11-07T04:05:48.153000",
"db": "NVD",
"id": "CVE-2023-20028"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202306-2002"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting vulnerability in multiple Cisco Systems products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-024105"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202306-2002"
}
],
"trust": 0.6
}
}