Vulnslist

find the latest Cisco vulnerabilities

Cisco Email Security Appliance and Cisco Content Security Management Appliance Spam Quarantine Vulnerability

cisco-sa-20180207-esacsm · Medium · Published · Updated

A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the spam quarantine by modifying browser string information. The vulnerability is due to a lack of verification of authenticated user accounts. An attacker could exploit this vulnerability by modifying browser strings to see messages submitted by other users to the spam quarantine within their company. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-esacsm

Cisco advisory ·CSAF JSON

Workarounds

There are no workarounds that address this vulnerability.

CVEsCVE-2018-0140
Cisco Bug IDsCSCvg39759, CSCvg42295
CVSS ScoreBase 6.5
Base 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:X/RL:X/RC:X
Product Names From Source
Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), Cisco Secure Email, Cisco Secure Email and Web Manager

Related Products

Product CVE Evidence
Cisco Nexus Dashboard CVE-2018-0140 Cisco OpenVuln
Cisco Secure Email and Web Manager CVE-2018-0140 Cisco OpenVuln
Cisco Secure Email CVE-2018-0140 Cisco OpenVuln
Cisco Email Security Appliance (ESA) CVE-2018-0140 Cisco OpenVuln
Cisco Content Security Management Appliance (SMA) CVE-2018-0140 Cisco OpenVuln