CVE-2022-20664

A vulnerability in the web management interface of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance (ESA) could allow an authenticated, remote attacker to retrieve sensitive information from a Lightweight Directory Access Protocol (LDAP) external authentication server connected to an affected device. This vulnerability is due to a lack of proper input sanitization while querying the external authentication server. An attacker could exploit this vulnerability by sending a crafted query through an external authentication web page. A successful exploit could allow the attacker to gain access to sensitive information, including user credentials from the external authentication server. To exploit this vulnerability, an attacker would need valid operator-level (or higher) credentials.

• CWE-497
• CWE-200

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esasma-info-dsc-Q9tLuOvMVendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esasma-info-dsc-Q9tLuOvMVendor Advisory

Published

Jun 15, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-20659A vulnerability in the web-based management interface of Cis…6.1
• CVE-2022-2066Cross-site Scripting (XSS) - Reflected in GitHub repository …6.1
• CVE-2022-20660A vulnerability in the information storage architecture of s…4.6
• CVE-2022-20661Multiple vulnerabilities that affect Cisco Catalyst Digital …4.6
• CVE-2022-20662A vulnerability in the smart card login authentication of Ci…6.8
• CVE-2022-20663A vulnerability in the web-based management interface of Cis…6.1
• CVE-2022-20665A vulnerability in the CLI of Cisco StarOS could allow an au…6.7
• CVE-2022-20666Multiple vulnerabilities in the web-based management interfa…6.1
• CVE-2022-20667Multiple vulnerabilities in the web-based management interfa…6.1
• CVE-2022-20668Multiple vulnerabilities in the web-based management interfa…6.1
• CVE-2022-20669Multiple vulnerabilities in the web-based management interfa…6.1
• CVE-2022-2067SQL Injection in GitHub repository francoisjacquet/rosariosi…9.1