CVE-2019-1955: falha de média gravidade em Cisco Email Security Appliance (ESA)
Cisco Email Security Appliance Header Injection Vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 1.4%
A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass configured user filters on the device. The vulnerability is due to incomplete input and validation checking mechanisms for certain SPF messages that are sent to an affected device. An attacker could exploit this vulnerability by sending a customized SPF packet to an affected device. A successful exploit could allow the attacker to bypass the header filters that are configured for the affected device, which could allow malicious content to pass through the device.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
Cisco · Cisco Email Security Appliance (ESA)CVEs relacionadas — Cisco Email Security Appliance (ESA)
No mesmo produto, das mais perigosas para as menos.
CVE-2018-15460HIGHCisco Email Security Appliance URL Filtering Denial of Service VulnerabilityEPSS 2.5%CVE-2018-15453HIGHCisco Email Security Appliance Memory Corruption Denial of Service VulnerabilityEPSS 2.3%CVE-2018-0447—Cisco Email Security Appliance URL Filtering Bypass VulnerabilityEPSS 2.3%CVE-2019-1947HIGHCisco Email Security Appliance Denial of Service VulnerabilityEPSS 1.9%CVE-2019-1983HIGHCisco Email Security Appliance and Cisco Content Security Management Appliance Denial of Service VulnerabilityEPSS 1.9%CVE-2022-20653HIGHCisco Email Security Appliance DNS Verification Denial of Service VulnerabilityEPSS 1.8%