What’s Vulnerable › Vulnerabilities

CVE-2020-29022: Host Header Injection allowing web cache poisoning attacks

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-02-16 · updated 2026-06-17
• Weakness: CWE-159

Description

Failure to Sanitize host header value on output in the GateManager Web server could allow an attacker to conduct web cache poisoning attacks. This issue affects Secomea GateManager all versions prior to 9.3

Affected products

• Secomea Gatemanager 4250 Firmware: all versions
• Secomea Gatemanager 4260 Firmware: all versions
• Secomea GateManager all versions prior to 9.2c: before 9.3 — fixed in 9.3
• Secomea Gatemanager 9250 Firmware: all versions

How to fix

Upgrade to a fixed version: Secomea GateManager all versions prior to 9.2c 9.3. Check the vendor advisory for mitigations.

References

• https://www.secomea.com/support/cybersecurity-advisory/#2923
• https://www.secomea.com/support/cybersecurity-advisory/#2923

Get alerted when CVE-2020-29022 or the next vulnerability affects your stack