Cisco Content Security Management Appliance Authorization Email improper authorization

Summaryinfo

A vulnerability marked as critical has been reported in Cisco Content Security Management Appliance. This impacts an unknown function of the component Authorization Module. This manipulation causes improper authorization (Email). This vulnerability is handled as CVE-2019-12635. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco Content Security Management Appliance (the affected version is unknown). It has been declared as critical. Affected by this vulnerability is an unknown code of the component Authorization Module. The manipulation with an unknown input leads to a improper authorization vulnerability (Email). The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the authorization module of Cisco Content Security Management Appliance (SMA) Software could allow an authenticated, remote attacker to gain out-of-scope access to email. The vulnerability exists because the affected software does not correctly implement role permission controls. An attacker could exploit this vulnerability by using a custom role with specific permissions. A successful exploit could allow the attacker to access the spam quarantine of other users.

The weakness was released 09/05/2019 as cisco-sa-20190904-sma-info-dis as confirmed advisory (Website). It is possible to read the advisory at tools.cisco.com. This vulnerability is known as CVE-2019-12635 since 06/04/2019. The attack can be launched remotely. A single authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Cisco

Name

• Content Security Management Appliance

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion