CVE-2018-15460 — Improper Input Validation in Cisco Asyncos

CWE-20 — Improper Input ValidationCWE-770 — Allocation of Resources Without Limits or Throttling4 documents4 sources
Severity
8.6HIGHNVD
EPSS
0.4%
top 40.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco AsyncosCisco Email Security Appliance
Timeline
PublishedJan 10
Latest updateMay 13

Description

A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to cause the CPU utilization to increase to 100 percent, causing a denial of service (DoS) condition on an affected device. The vulnerability is due to improper filtering of email messages that contain references to whitelisted URLs. An attacker could exploit this vulnerability by sending a malicious email message that contains…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HExploitability: 3.9 | Impact: 4.0

Affected Packages2 packages

▶NVDcisco/asyncos11.1.0 — 11.1.2-023_md+1

🔴Vulnerability Details

2
GHSA
GHSA-q66v-34fh-vw9m: A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthentica↗2022-05-13
▶
CVEList
Cisco Email Security Appliance URL Filtering Denial of Service Vulnerability↗2019-01-10
▶

📋Vendor Advisories

1
Cisco
Cisco Email Security Appliance URL Filtering Denial of Service Vulnerability↗2019-01-09
▶
CVE-2018-15460 — Improper Input Validation in Cisco | cvebase