CVE-2019-1955

CWE-20 — Improper Input Validation4 documents4 sources
Severity
7.5HIGH
EPSS
0.2%
top 56.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Cisco Email Security Appliance (esa)Cisco Email Security Appliance Firmware
Timeline
PublishedAug 8
Latest updateMay 24

Description

A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass configured user filters on the device. The vulnerability is due to incomplete input and validation checking mechanisms for certain SPF messages that are sent to an affected device. An attacker could exploit this vulnerability by sending a customized SPF packet to an affected device. A successful exploit co…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5cisco/cisco_email_security_appliance_(esa)unspecified — n/a

🔴Vulnerability Details

2
GHSA
GHSA-x58p-f2fr-mr4f: A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an↗2022-05-24
▶
CVEList
Cisco Email Security Appliance Header Injection Vulnerability↗2019-08-08
▶

📋Vendor Advisories

1
Cisco
Cisco Email Security Appliance Header Injection Vulnerability↗2019-08-07
▶
CVE-2019-1955 (HIGH CVSS 7.5) | A vulnerability in the Sender Polic | cvebase.io