CVE-2022-20651 Cisco Adaptive Security Device Manager Information Disclosure Vulnerability
An authenticated local attacker can view other users' credentials in clear text logs on shared Cisco ASDM workstations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-20651?
CVE-2022-20651 is a medium-severity vulnerability in Cisco Adaptive Security Device Manager (ASDM), published on 22 Jun 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability in the logging component of Cisco Adaptive Security Device Manager (ASDM) could allow an authenticated, local attacker to view sensitive information in clear text on an affected system. Cisco ADSM must be deployed in a shared workstation environment for this issue to be exploited. This vulnerability is due to the storage of unencrypted credentials in certain logs. An attacker could exploit this vulnerability by accessing the logs on an affected system. A successful exploit could allow the attacker to view the credentials of other users of the shared device.
Weakness: CWE-532
Which versions are affected by CVE-2022-20651?
It affects 1 product.
Products include Cisco Adaptive Security Device Manager.
How do I fix CVE-2022-20651?
No fix has been published for CVE-2022-20651 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-20651 being exploited?
There is no known exploitation of CVE-2022-20651 in the wild and no public exploit code.
Other vulnerabilities in Cisco Adaptive Security Device Manager (ASDM)
Sources
Also known as GHSA-ph5j-6pcv-6w76.