CVE-2017-12309
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to conduct a HTTP response splitting attack. The vulnerability is due to the failure of the application or its environment to properly sanitize input values. An attacker could exploit this vulnerability by injecting malicious HTTP headers, controlling the response body, or splitting the response into multiple responses. An exploit could allow the attacker to perform cross-site scripting attacks, cross-user defacement, web cache poisoning, and similar exploits. Cisco Bug IDs: CSCvf16705.
Una vulnerabilidad en Cisco Email Security Appliance (ESA) podría permitir que un atacante remoto no autenticado lleve a cabo un ataque de separación de respuestas HTTP. La vulnerabilidad se debe a que la aplicación o su entorno fracasan a la hora de sanitizar los valores de entrada. Un atacante podría explotar esta vulnerabilidad inyectando cabeceras HTTP maliciosas, controlando el cuerpo de la respuesta o dividiendo la respuesta en múltiples respuestas. Un exploit podría permitir que el atacante realice ataques de Cross-Site Scripting, desfiguración cruzada de usuario, envenenamiento de caché DNS o exploits similares. Cisco Bug IDs: CSCvf16705.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-08-03 CVE Reserved
- 2017-11-16 CVE Published
- 2023-05-19 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
http://www.securityfocus.com/bid/101928 | Third Party Advisory | |
http://www.securitytracker.com/id/1039831 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-esa | 2019-10-09 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cisco Search vendor "Cisco" | Email Security Appliance Firmware Search vendor "Cisco" for product "Email Security Appliance Firmware" | 10.0.2-020 Search vendor "Cisco" for product "Email Security Appliance Firmware" and version "10.0.2-020" | - |
Affected
| ||||||
Cisco Search vendor "Cisco" | Email Security Appliance Firmware Search vendor "Cisco" for product "Email Security Appliance Firmware" | 11.0.0-105 Search vendor "Cisco" for product "Email Security Appliance Firmware" and version "11.0.0-105" | - |
Affected
|