Improper input validation in Cisco Email Security Appliance (Esa)
CVE-2019-1955
A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass configured user filters on the device. The vulnerability is due to incomplete input and validation checking mechanisms for certain SPF messages that are sent to an affected device. An attacker could exploit this vulnerability by sending a customized SPF packet to an affected device. A successful exploit could allow the attacker to bypass the header filters that are configured for the affected device, which could allow malicious content to pass through the device.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.014 (70.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Cisco Email Security Appliance (Esa) — versions unspecified
- Cisco Email_security_appliance_firmware — versions 12.0
Weakness classification (CWE)
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-1955?
- CVE-2019-1955 is a high-severity vulnerability in Cisco Email Security Appliance (Esa), classified under Improper Input Validation. CVSS score: 7.5/10. Published 2019-08-08.
- How severe is CVE-2019-1955?
- High severity. CVSS v3 base score is 7.5 out of 10.