CVE-2014-2195

Published: May 20, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cisco AsyncOS on Email Security Appliance (ESA) and Content Security Management Appliance (SMA) devices, when Active Directory is enabled, does not properly handle group names, which allows remote attackers to gain role privileges by leveraging group-name similarity, aka Bug ID CSCum86085.

Affected (3)

Products: Cisco: Asyncos, Content Security Management Appliance, Email Security Appliance Firmware

3 products

Content Security Management Appliance

Email Security Appliance Firmware

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Cisco Asyncos	All versions
Cisco Content Security Management Appliance	All versions
Cisco Email Security Appliance Firmware	All versions

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2195

Source: psirt@cisco.com

Vendor Advisory

http://www.securitytracker.com/id/1030258

Source: psirt@cisco.com

Third Party AdvisoryVDB Entry

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2195

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securitytracker.com/id/1030258

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.