How severe is CVE-2022-20772?

CVE-2022-20772 has a CVSS 3.x base score of 4.7, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2022-20772 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-20772?

CVE-2022-20772 primarily affects Cisco Email Security Appliance Firmware. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2022-20772?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-20772 published?

CVE-2022-20772 was published on 2022-11-04 and last updated on 2026-06-17.

CVE-2022-20772

CVE-2022-20772 is a medium-severity vulnerability in Cisco Email Security Appliance Firmware with a CVSS 3.x base score of 4.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-74.

Key facts

Severity: Medium (CVSS 3.x base score 4.7)
EPSS exploit prediction: 1% (42nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-74
Affected product: Cisco Email Security Appliance Firmware
Published: 2022-11-04
Last modified: 2026-06-17

Description

A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This vulnerability is due to the failure of the application or its environment to properly sanitize input values. An attacker could exploit this vulnerability by injecting malicious HTTP headers, controlling the response body, or splitting the response into multiple responses.

Frequently asked questions

What is CVE-2022-20772?: A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This vulnerability is due to the failure of the application or its environment to properly sanitize input values. An attacker could exploit this vulnerability by injecting malicious HTTP headers, controlling the response body, or splitting the response into multiple responses.
How severe is CVE-2022-20772?: CVE-2022-20772 has a CVSS 3.x base score of 4.7, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2022-20772 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-20772?: CVE-2022-20772 primarily affects Cisco Email Security Appliance Firmware. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2022-20772?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-20772 published?: CVE-2022-20772 was published on 2022-11-04 and last updated on 2026-06-17.

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ESA-HTTP-Inject-nvsycUmR

Affected products (2)

cpe:2.3:o:cisco:email_security_appliance_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:secure_email_and_web_manager_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Cisco Email Security Appliance Firmware

CVE-2016-6406 — Critical (CVSS 9.8): Cisco IronPort AsyncOS 9.1.2-023, 9.1.2-028, 9.1.2-036, 9.7.2-046, 9.7.2-047, 9.7.2-054, 10.0.0-124, and 10.0.0-125 on…
CVE-2018-15453 — High (CVSS 8.6): A vulnerability in the Secure/Multipurpose Internet Mail Extensions (S/MIME) Decryption and Verification or S/MIME…
CVE-2014-2119 — High (CVSS 8.5): The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) before…
CVE-2013-5537 — High (CVSS 7.8): The web framework on Cisco Web Security Appliance (WSA), Email Security Appliance (ESA), and Content Security…
CVE-2019-15961 — High (CVSS 7.5): A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could…
CVE-2019-12706 — High (CVSS 7.5): A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security…

All CVEs affecting Cisco Email Security Appliance Firmware →

Other CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities

CVE-2026-25586 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty…
CVE-2026-25520 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped.…
CVE-2025-20265 — Critical (CVSS 10.0): A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could…
CVE-2025-20337 — Critical (CVSS 10.0): A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
CVE-2025-20281 — Critical (CVSS 10.0): A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
CVE-2024-42472 — Critical (CVSS 10.0): Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious…

Browse all CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities →