CVE-2022-20759

A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, but unprivileged, remote attacker to elevate privileges to level 15. This vulnerability is due to improper separation of authentication and authorization scopes. An attacker could exploit this vulnerability by sending crafted HTTPS messages to the web services interface of an affected device. A successful exploit could allow the attacker to gain privilege level 15 access to the web management interface of the device. This includes privilege level 15 access to the device using management tools like the Cisco Adaptive Security Device Manager (ASDM) or the Cisco Security Manager (CSM). Note: With Cisco FTD Software, the impact is lower than the CVSS score suggests because the affected web management interface allows for read access only.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:firepower_threat_defense:7.1.0:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*

History

13 May 2022, 18:03

Type Values Removed Values Added
First Time Cisco
Cisco adaptive Security Appliance Software
Cisco firepower Threat Defense
CVSS v2 : unknown
v3 : unknown
v2 : 8.5
v3 : 8.8
References (CISCO) https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-mgmt-privesc-BMFMUvye - (CISCO) https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-mgmt-privesc-BMFMUvye - Vendor Advisory
References (MISC) https://github.com/orangecertcc/security-research/security/advisories/GHSA-gq88-gqmj-7v24 - (MISC) https://github.com/orangecertcc/security-research/security/advisories/GHSA-gq88-gqmj-7v24 - Exploit, Third Party Advisory
CWE CWE-269
CPE cpe:2.3:a:cisco:firepower_threat_defense:7.1.0:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*

09 May 2022, 18:15

Type Values Removed Values Added
References
  • (MISC) https://github.com/orangecertcc/security-research/security/advisories/GHSA-gq88-gqmj-7v24 -

03 May 2022, 04:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-05-03 04:15

Updated : 2023-12-10 14:22


NVD link : CVE-2022-20759

Mitre link : CVE-2022-20759

CVE.ORG link : CVE-2022-20759


JSON object : View

Products Affected

cisco

  • firepower_threat_defense
  • adaptive_security_appliance_software
CWE
CWE-269

Improper Privilege Management

CWE-266

Incorrect Privilege Assignment