CVE-2022-20736

A vulnerability in the web-based management interface of Cisco AppDynamics Controller Software could allow an unauthenticated, remote attacker to access a configuration file and the login page for an administrative console that they would not normally have authorization to access. This vulnerability is due to improper authorization checking for HTTP requests that are submitted to the affected web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected instance of AppDynamics Controller. A successful exploit could allow the attacker to access the login page for an administrative console. AppDynamics has released software updates that address this vulnerability.

• CWE-939
• CWE-862

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-appd-contrl-athzn-bp-BLypgsbuVendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-appd-contrl-athzn-bp-BLypgsbuVendor Advisory

Published

Jun 15, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-20730A vulnerability in the Security Intelligence feed feature of…7.5
• CVE-2022-20731Multiple vulnerabilities that affect Cisco Catalyst Digital …6.8
• CVE-2022-20732A vulnerability in the configuration file protections of Cis…7.8
• CVE-2022-20733A vulnerability in the login page of Cisco Identity Services…9.8
• CVE-2022-20734A vulnerability in Cisco SD-WAN vManage Software could allow…4.4
• CVE-2022-20735A vulnerability in the web-based management interface of Cis…6.5
• CVE-2022-20737A vulnerability in the handler for HTTP authentication for r…7.1
• CVE-2022-20738A vulnerability in the Cisco Umbrella Secure Web Gateway ser…9.8
• CVE-2022-20739A vulnerability in the CLI of Cisco SD-WAN vManage Software …7.3
• CVE-2022-2074In affected versions of Octopus Deploy it is possible to per…7.5
• CVE-2022-20740A vulnerability in the web-based management interface of Cis…6.1
• CVE-2022-20741A vulnerability in the web-based management interface of the…5.4