CVE-2022-20664 (CNNVD-202206-1538)
中文标题:
Cisco多款产品 信息泄露漏洞
英文标题:
Cisco Email Security Appliance and Cisco Secure Email and Web Manager Information Disclosure Vulnerability
漏洞描述
中文描述:
Cisco Email Security Appliance（ESA）和Cisco Secure Email都是美国思科（Cisco）公司的产品。Cisco Email Security Appliance是一个电子邮件安全设备。Cisco Secure Email是思科安全电子邮件（前身为电子邮件安全）为您的电子邮件提供最佳保护，使其免受网络威胁。 Cisco Email Security Appliance、Secure Email 和 Web Manager 存在安全漏洞，该漏洞源于查询外部身份验证服务器时缺少正确的输入清理。经过身份验证的远程攻击者利用该漏洞能够从连接到受影响设备的轻型目录访问协议 （LDAP） 外部身份验证服务器检索敏感信息。
英文描述:
A vulnerability in the web management interface of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance (ESA) could allow an authenticated, remote attacker to retrieve sensitive information from a Lightweight Directory Access Protocol (LDAP) external authentication server connected to an affected device. This vulnerability is due to a lack of proper input sanitization while querying the external authentication server. An attacker could exploit this vulnerability by sending a crafted query through an external authentication web page. A successful exploit could allow the attacker to gain access to sensitive information, including user credentials from the external authentication server. To exploit this vulnerability, an attacker would need valid operator-level (or higher) credentials.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Cisco | Cisco Email Security Appliance (ESA) | n/a | - | - |
cpe:2.3:a:cisco:cisco_email_security_appliance_(esa):n_a:*:*:*:*:*:*:*
|
| cisco | email_security_appliance | * | - | - |
cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:*
|
| cisco | secure_email_and_web_manager | * | - | - |
cpe:2.3:a:cisco:secure_email_and_web_manager:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
3.1 (cna)
HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2022-20664 |
2025-11-11 15:21:15 | 2025-11-11 07:37:15 |
| NVD | nvd_CVE-2022-20664 |
2025-11-11 14:58:19 | 2025-11-11 07:45:31 |
| CNNVD | cnnvd_CNNVD-202206-1538 |
2025-11-11 15:10:55 | 2025-11-11 07:57:20 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 信息泄露
- cnnvd_id: 未提取 -> CNNVD-202206-1538
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 3
- data_sources: ['cve'] -> ['cve', 'nvd']