Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-0140


A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the spam quarantine by modifying browser string information. The vulnerability is due to a lack of verification of authenticated user accounts. An attacker could exploit this vulnerability by modifying browser strings to see messages submitted by other users to the spam quarantine within their company. Cisco Bug IDs: CSCvg39759, CSCvg42295.


Security Impact Summary

This vulnerability carries a MEDIUM severity rating with a CVSS v3.1 score of 6.5, indicating it can be exploited remotely over the network with relatively low complexity without requiring user interaction requiring only low-level privileges . The vulnerability impacts confidentiality (data exposure), for affected systems. Impacting 19 products from cisco, from cisco, from cisco and 16 others, organizations running these solutions should prioritize assessment and patching.

Historical Context

First disclosed in 2018, this vulnerability was reported during a period defined by widespread IoT adoption challenges, mobile security concerns, and the emergence of advanced persistent threat (APT) techniques. Contemporary mitigation strategies focused on secure development practices and third-party component vetting.


Published

2018-02-08T07:29:01.053

Last Modified

2024-11-21T03:37:35.953

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-200
  • Type: Primary
    CWE-425

Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System cisco email_security_appliance_firmware 9.8.0-112 Yes
Operating System cisco email_security_appliance_firmware 10.0.1-087 Yes
Operating System cisco email_security_appliance_firmware 11.0.0-274 Yes
Hardware cisco email_security_appliance_c160 - No
Hardware cisco email_security_appliance_c170 - No
Hardware cisco email_security_appliance_c190 - No
Hardware cisco email_security_appliance_c370 - No
Hardware cisco email_security_appliance_c370d - No
Hardware cisco email_security_appliance_c380 - No
Hardware cisco email_security_appliance_c390 - No
Hardware cisco email_security_appliance_c670 - No
Hardware cisco email_security_appliance_c680 - No
Hardware cisco email_security_appliance_c690 - No
Hardware cisco email_security_appliance_c690x - No
Hardware cisco email_security_appliance_x1070 - No
Operating System cisco content_security_management_appliance 10.0.0-096 Yes
Operating System cisco content_security_management_appliance 10.1.0-037 Yes
Operating System cisco content_security_management_appliance 10.1.0-052 Yes
Operating System cisco content_security_management_appliance 11.0.0-115 Yes
Hardware cisco content_security_management_appliance_sma_m190 - No
Hardware cisco content_security_management_appliance_sma_m390 - No
Hardware cisco content_security_management_appliance_sma_m390x - No
Hardware cisco content_security_management_appliance_sma_m690 - No
Hardware cisco content_security_management_appliance_sma_m690x - No

References

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For cisco's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.