What is CVE-2018-0447?

CVE-2018-0447 is a medium-severity vulnerability in Cisco Email Security Appliance (Esa), classified under Improper Access Control. CVSS score: 5.3/10. Published 2018-10-05.

How severe is CVE-2018-0447?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Improper input validation in Cisco Email Security Appliance (Esa)

CVE-2018-0447

A vulnerability in the anti-spam protection mechanisms of Cisco AsyncOS Software for the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass certain content filters on an affected device. The vulnerability is due to incomplete input and validation checking mechanisms for certain Sender Policy Framework (SPF) messages that are sent to an affected device. An attacker could exploit this vulnerability by sending a customized SPF packet to an affected device. If successful, an exploit could allow the attacker to bypass the URL filters that are configured for the affected device, which could allow malicious URLs to pass through the device.

EPSS: 0.023 (81.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Cisco Email Security Appliance (Esa) — versions n/a
Cisco Email_security_appliance

Weakness classification (CWE)

References

psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2018-0447?: CVE-2018-0447 is a medium-severity vulnerability in Cisco Email Security Appliance (Esa), classified under Improper Access Control. CVSS score: 5.3/10. Published 2018-10-05.
How severe is CVE-2018-0447?: Medium severity. CVSS v3 base score is 5.3 out of 10.