Cisco Security Advisory - Cisco Email Security Appliance and Cisco Secure Email and Web Manager External Authentication Bypass Vulnerability

[Netwörkheäd]

Cisco Email Security Appliance and Cisco Secure Email and Web Manager External Authentication Bypass Vulnerability

<p>A vulnerability in the external authentication functionality of Cisco&nbsp;Secure Email and Web Manager, formerly known as Cisco&nbsp;Security Management Appliance (SMA), and Cisco&nbsp;Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass authentication and log in to the web management interface of an affected device.</p>
<p>This vulnerability is due to improper authentication checks when an affected device uses Lightweight Directory Access Protocol (LDAP) for external authentication. An attacker could exploit this vulnerability by entering a specific input on the login page of the affected device. A successful exploit could allow the attacker to gain unauthorized access to the web-based management interface of the affected device.</p>
<p>Cisco&nbsp;has released software updates that address this vulnerability. There are workarounds that address this vulnerability.</p>
<p>This advisory is available at the following link:<br><a href="https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-esa-auth-bypass-66kEcxQD" target="_blank">https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-esa-auth-bypass-66kEcxQD</a></p>

     
         
Security Impact Rating:  Critical
   
   
       
CVE: CVE-2022-20798
Source: Cisco Email Security Appliance and Cisco Secure Email and Web Manager External Authentication Bypass Vulnerability