CVE-2022-20738

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability in the Cisco Umbrella Secure Web Gateway service could allow an unauthenticated, remote attacker to bypass the file inspection feature. This vulnerability is due to insufficient restrictions in the file inspection feature. An attacker could exploit this vulnerability by downloading a crafted payload through specific methods. A successful exploit could allow the attacker to bypass file inspection protections and download a malicious payload.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-693

Affected software

No affected versions have been published.

Timeline

Published
Feb 10, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-207397.3A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to execute arbitrary commands on thCVE-2022-20747.5In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template.CVE-2022-207406.1A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, reCVE-2022-207415.4A vulnerability in the web-based management interface of the Network Diagrams application for Cisco Secure Network Analytics, formerly StealCVE-2022-207427.4A vulnerability in an IPsec VPN library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) SoftwarCVE-2022-207438.8A vulnerability in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attCVE-2022-207446.5A vulnerability in the input protection mechanisms of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote CVE-2022-207457.5A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco FCVE-2022-207467.5A vulnerability in the TCP proxy functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacCVE-2022-207476.5A vulnerability in the History API of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain access to sensitivCVE-2022-207485.3A vulnerability in the local malware analysis process of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remotCVE-2022-207499.8Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the foll
CVE-2022-20738: Critical severity, CVSS 9.8 | Vulnix