Skip to content
Fencer Vulns
medium 6.5

CVE-2022-20942 json

A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and Web Manager, and Cisc…

published 2022-11-03 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-26192

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance, formerly known as Cisco Web Security Appliance (WSA), could allow an authenticated, remote attacker to retrieve sensitive information from an affected device, including user credentials. This vulnerability is due to weak enforcement of back-end authorization checks. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain confidential data that is stored on the affected device.

Patch / fix

  • cisco asyncos 12.0.5-011, 12.5.4-005, 14.0.2-012, 14.2.0-217, 14.2.1-015, 14.3.0-023, 14.3.0-115

Exploit prediction

1.09% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

  • Cisco Cisco Secure Web Appliance
  • Cisco Cisco Secure Email
  • Cisco Cisco Secure Email and Web Manager

Classification

Weakness
  • CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
  • CWE-863 Incorrect Authorization

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.