PT-2022-5702 · Cisco · Cisco Firepower Management Center

Albert Sanchez · Published 2022-11-09 · Updated 2024-11-26 · CVE-2022-20941

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Firepower Management Center (FMC) Software (affected versions not specified)

Description The issue is related to insufficient entropy in resource names and missing authorization for certain resources in the web-based management interface. This could allow a remote attacker to gain unauthorized access to sensitive information by sending specially crafted HTTPS requests. The attacker could exploit this by enumerating resources on the device, potentially leading to the retrieval of sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Use of Insufficiently Random Values

Weakness Enumeration

CWE-862

CWE-331

CWE-334

CWE-330

Related Identifiers

BDU:2022-07099

CVE-2022-20941

Affected Products

Cisco Firepower Management Center

References · 6

• https://bdu.fstec.ru/vul/2022-07099 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-info-disc-UghNRRhP · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20941 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20941 · Vendor Advisory
• https://vuldb.com/?id.213300 · Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-info-disc-UghNRRhP · Note