// For flags

CVE-2022-20744

Cisco Firepower Management Center Software Information Disclosure Vulnerability

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

A vulnerability in the input protection mechanisms of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to view data without proper authorization. This vulnerability exists because of a protection mechanism that relies on the existence or values of a specific input. An attacker could exploit this vulnerability by modifying this input to bypass the protection mechanism and sending a crafted request to an affected device. A successful exploit could allow the attacker to view data beyond the scope of their authorization.

Una vulnerabilidad en los mecanismos de protección de entrada del software Cisco Firepower Management Center (FMC) podría permitir a un atacante remoto autenticado visualizar datos sin autorización apropiada. Esta vulnerabilidad se presenta debido a un mecanismo de protección que es basado en la existencia o los valores de una entrada específica. Un atacante podría explotar esta vulnerabilidad al modificar esta entrada para omitir el mecanismo de protección y vulnerabilidad mediante el envío de una petición diseñada a un dispositivo afectado. Una explotación con éxito podría permitir al atacante visualizar datos más allá del alcance de su autorización

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2021-11-02 CVE Reserved
  • 2022-05-03 CVE Published
  • 2024-07-19 EPSS Updated
  • 2024-11-06 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-807: Reliance on Untrusted Inputs in a Security Decision
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Firepower Management Center
Search vendor "Cisco" for product "Firepower Management Center"
 < 7.1.0
Search vendor "Cisco" for product "Firepower Management Center" and version " < 7.1.0"
-
Affected