{"uuid": "60b6a13e-2363-407f-9508-649ba2fce9d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-20798", "type": "seen", "source": "https://t.me/hacking_Attack/57536", "content": "Black Hat Ethical Hacking\nCisco Secure Email bug can let attackers bypass authentication\n\nCisco Secure Email bug can let attackers bypass authenticationPost Views: 1 \nPremium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nCisco notified customers this week to patch a critical vulnerability that could allow attackers to bypass authentication and login into the web management interface of Cisco email gateway appliances with non-default configurations.\nThe security flaw (tracked as CVE-2022-20798) was found in the external authentication functionality of virtual and hardware Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager appliances.\n\nCVE-2022-20798 is due to improper authentication checks on affected devices using Lightweight Directory Access Protocol (LDAP) for external authentication.\n\n\u201cAn attacker could exploit this vulnerability by entering a specific input on the login page of the affected device,\u201d Cisco explained.\n\n\u201cA successful exploit could allow the attacker to gain unauthorized access to the web-based management interface of the affected device.\u201d\n\nAn advisory published on Wednesday says\u00a0the bug was discovered during the resolution of a Cisco TAC (Technical Assistance Center) support case.\n\nCisco\u2019s Product Security Incident Response Team (PSIRT) said it\u2019s not aware of any publicly available exploits for this security bug or malicious use of the vulnerability in the wild.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Doesn\u2019t affect default configurationsThis bug only affects appliances configured to use external authentication and LDAP as the authentication protocol.\n\nLuckily, according to Cisco, the external authentication feature is disabled by default, meaning only devices with non-default configurations are impacted.\n\nTo check if external auth is enabled on your appliance, log into the web-based management interface, go to System Administration > Users, and look for a green check box next to \u201cEnable External Authentication.\u201d\nSee Also: This new Linux malware is \u2018almost impossible\u2019 to detect Cisco also says this vulnerability does not affect its Cisco Secure Web Appliance product, previously known as Cisco Web Security Appliance (WSA).\n\nAdmins who cannot immediately install CVE-2022-20798 security updates can also apply a workaround that requires disabling anonymous binds on the external authentication server.\n\nAnother Secure Email gateway flaw patched in February\u00a0could allow remote attackers to crash unpatched appliances using maliciously\u00a0crafted email messages.\nSee Also: Recon Tool: Domain Analyzer Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nToday, Cisco also announced it wouldn\u2019t fix a critical zero-day bug\u00a0affecting end-of-life RV110W, RV130, RV130W, and RV215W SMB routers, allowing attackers to execute arbitrary commands with root-level privileges.\nSee Also: The Difference between Vulnerability Assessment and Pentesting\nSource: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/android-malware-90x90.jpg Android malware on the Google Play Store gets 2 million downloads1 day [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:35.892297Z"}