CVE-2018-0140

Published: Feb 8, 2018Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the spam quarantine by modifying browser string information. The vulnerability is due to a lack of verification of authenticated user accounts. An attacker could exploit this vulnerability by modifying browser strings to see messages submitted by other users to the spam quarantine within their company. Cisco Bug IDs: CSCvg39759, CSCvg42295.

Affected (7)

Products: Cisco: Email Security Appliance Firmware, Content Security Management Appliance

Cisco

2 products

Email Security Appliance Firmware

Content Security Management Appliance

Configuration A

3 vulnerable · 12 platform

Vulnerable Software	Affected Versions
Cisco Email Security Appliance Firmware	Version 10.0.1-087
Cisco Email Security Appliance Firmware	Version 11.0.0-274
Cisco Email Security Appliance Firmware	Version 9.8.0-112

Running on/with	Platform Versions
Cisco Email Security Appliance C160	All versions
Cisco Email Security Appliance C170	All versions
Cisco Email Security Appliance C190	All versions
Cisco Email Security Appliance C370	All versions
Cisco Email Security Appliance C370d	All versions
Cisco Email Security Appliance C380	All versions
Cisco Email Security Appliance C390	All versions
Cisco Email Security Appliance C670	All versions
Cisco Email Security Appliance C680	All versions
Cisco Email Security Appliance C690	All versions
Cisco Email Security Appliance C690x	All versions
Cisco Email Security Appliance X1070	All versions

Configuration B

4 vulnerable · 5 platform

Vulnerable Software	Affected Versions
Cisco Content Security Management Appliance	Version 10.0.0-096
Cisco Content Security Management Appliance	Version 10.1.0-037
Cisco Content Security Management Appliance	Version 10.1.0-052
Cisco Content Security Management Appliance	Version 11.0.0-115

Running on/with	Platform Versions
Cisco Content Security Management Appliance Sma M190	All versions
Cisco Content Security Management Appliance Sma M390	All versions
Cisco Content Security Management Appliance Sma M390x	All versions
Cisco Content Security Management Appliance Sma M690	All versions
Cisco Content Security Management Appliance Sma M690x	All versions