CVE-2019-12635
Cisco Content Security Management Appliance Information Disclosure Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in the authorization module of Cisco Content Security Management Appliance (SMA) Software could allow an authenticated, remote attacker to gain out-of-scope access to email. The vulnerability exists because the affected software does not correctly implement role permission controls. An attacker could exploit this vulnerability by using a custom role with specific permissions. A successful exploit could allow the attacker to access the spam quarantine of other users.
Una vulnerabilidad en el módulo de autorización de Cisco Content Security Management Appliance (SMA) Software, podría permitir a un atacante remoto autenticado conseguir acceso al correo electrónico fuera de alcance. La vulnerabilidad se presenta porque el software afectado no implementa correctamente los controles de permisos de roles. Un atacante podría explotar esta vulnerabilidad mediante el uso de un rol personalizado con permisos específicos. Una explotación con éxito podría permitir al atacante acceder a la cuarentena del spam de otros usuarios.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2019-06-04 CVE Reserved
- 2019-09-05 CVE Published
- 2023-03-08 EPSS Updated
- 2024-11-21 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-285: Improper Authorization
- CWE-732: Incorrect Permission Assignment for Critical Resource
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cisco Search vendor "Cisco" | Content Security Management Appliance Search vendor "Cisco" for product "Content Security Management Appliance" | < 12.5.0 Search vendor "Cisco" for product "Content Security Management Appliance" and version " < 12.5.0" | - |
Affected
|