CVE-2022-20633: medium-severity vulnerability in Cisco Enterprise Chat and Email
Cisco Enterprise Chat and Email Username Enumeration Vulnerability
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
An attacker can discover valid usernames on Cisco ECE by observing how the system responds differently to login attempts with existing versus non-existing accounts. This information helps attackers prepare for further attacks like password guessing.
The web-based management interface exhibits information disclosure through inconsistent authentication error responses (CWE-204), allowing unauthenticated remote attackers to enumerate valid user accounts via differential analysis of HTTP responses. This username enumeration facilitates subsequent credential attacks and privilege escalation attempts.
In the same product, most dangerous first.