HTTP response splitting in Cisco Secure Email
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This vulnerability is due to the failure of the application or its environment to properly sanitize input values. An attacker could exploit this vulnerability by injecting malicious HTTP headers, controlling the response body, or splitting the response into multiple responses.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Secure Email | 13.5.1-277; 14.0.0-698; 14.2.0-620 | — | No fix listed | CNA |
| Cisco | Cisco Secure Email and Web Manager | 14.0.0-404; 14.1.0-223; 14.1.0-227; 14.2.0-212 | — | No fix listed | CNA |
- Cisco Secure Email VendorCisco Affected 13.5.1-277; 14.0.0-698; 14.2.0-620 Fixed in — No fix listed CNA
- Cisco Secure Email and Web Manager VendorCisco Affected 14.0.0-404; 14.1.0-223; 14.1.0-227; 14.2.0-212 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cisco:email_security_appliance_firmware:*:*:*:*:*:*:*:* | 13.5.1 to before 14.0.3-015; 14.1 to before 14.2.1-015; 14.3 to before 14.3.0-023 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:email_security_appliance:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:secure_email_and_web_manager_firmware:*:*:*:*:*:*:*:* | 14.2 to before 14.2.0-217; 14.3 to before 14.3.0-115 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:secure_email_and_web_manager:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:o:cisco:email_security_appliance_firmware:*:*:*:*:*:*:*:* Versions 13.5.1 to before 14.0.3-015; 14.1 to before 14.2.1-015; 14.3 to before 14.3.0-023 Vulnerable ·Cisco
- cpe:2.3:h:cisco:email_security_appliance:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:secure_email_and_web_manager_firmware:*:*:*:*:*:*:*:* Versions 14.2 to before 14.2.0-217; 14.3 to before 14.3.0-115 Vulnerable ·Cisco
- cpe:2.3:h:cisco:secure_email_and_web_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-20772
- 2026-10-03 Alias added: GHSA-9p6x-p535-c54c
- 2026-10-31 EPSS moved to the 50th–90th percentile
References
More Cisco Email Security Appliance Firmware vulnerabilities
- TI-2018-11013 Cisco Email Security Appliance Memory Corruption Denial of Service Vulnerability CVSS 3.1HIGH 8.6
- TI-2016-05488 Cisco IronPort AsyncOS 9.1.2-023, 9.1.2-028, 9.1.2-036, 9.7.2-046, 9.7.2-047, 9.7.2-054… CVSS 3.0CRITICAL 9.8
- TI-2019-12004 Clam AntiVirus (ClamAV) Software Email Parsing Vulnerability CVSS 3.1HIGH 7.5
- TI-2019-01575 Cisco Email Security Appliance Header Injection Vulnerability CVSS 3.1HIGH 7.5
- TI-2014-01669 The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email… CVSS 2.0HIGH 8.5
- TI-2019-09501 Cisco Email Security Appliance Filter Bypass Vulnerability CVSS 3.1HIGH 7.5
Sources
- CVE-2022-20772 · CVE Program
- CVE-2022-20772 · NVD
- FIRST EPSS
- GHSA-9p6x-p535-c54c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences