Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-0140

A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the spam quarantine by modifying browser string information. The vulnerability is due to a lack of verification of authenticated user accounts. An attacker could exploit this vulnerability by modifying browser strings to see messages submitted by other users to the spam quarantine within their company. Cisco Bug IDs: CSCvg39759, CSCvg42295.

Published

2018-02-08T07:29:01.053

Last Modified

2024-11-21T03:37:35.953

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-200
  • Type: Primary
    CWE-425
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System cisco email_security_appliance_firmware 9.8.0-112 Yes
Operating System cisco email_security_appliance_firmware 10.0.1-087 Yes
Operating System cisco email_security_appliance_firmware 11.0.0-274 Yes
Hardware cisco email_security_appliance_c160 - No
Hardware cisco email_security_appliance_c170 - No
Hardware cisco email_security_appliance_c190 - No
Hardware cisco email_security_appliance_c370 - No
Hardware cisco email_security_appliance_c370d - No
Hardware cisco email_security_appliance_c380 - No
Hardware cisco email_security_appliance_c390 - No
Hardware cisco email_security_appliance_c670 - No
Hardware cisco email_security_appliance_c680 - No
Hardware cisco email_security_appliance_c690 - No
Hardware cisco email_security_appliance_c690x - No
Hardware cisco email_security_appliance_x1070 - No
Operating System cisco content_security_management_appliance 10.0.0-096 Yes
Operating System cisco content_security_management_appliance 10.1.0-037 Yes
Operating System cisco content_security_management_appliance 10.1.0-052 Yes
Operating System cisco content_security_management_appliance 11.0.0-115 Yes
Hardware cisco content_security_management_appliance_sma_m190 - No
Hardware cisco content_security_management_appliance_sma_m390 - No
Hardware cisco content_security_management_appliance_sma_m390x - No
Hardware cisco content_security_management_appliance_sma_m690 - No
Hardware cisco content_security_management_appliance_sma_m690x - No
References