CVE-2020-3134
published 2020-01-26CVE-2020-3134: A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote…
PriorityP433medium6.5CVSS 3.1
AVNACLPRNUINSUCNILAL
EPSS
1.09%
61.5th percentile
A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of zip files. An attacker could exploit this vulnerability by sending an email message with a crafted zip-compressed attachment. A successful exploit could trigger a restart of the content-scanning process, causing a temporary DoS condition. This vulnerability affects Cisco AsyncOS Software for Cisco ESA releases earlier than 13.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_email_security_appliance | — | — |
| cisco | email_security_appliance | < 13.0 | 13.0 |
| cisco | email_security_appliance_zip_decompression_engine | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:P
vendor_cisco6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Email Security Appliance Zip Decompression Engine Denial of Service Vulnerability
vendor_cisco·2020-01-22·CVSS 6.5
CVE-2020-3134 [MEDIUM] CWE-20 Cisco Email Security Appliance Zip Decompression Engine Denial of Service Vulnerability
Cisco Email Security Appliance Zip Decompression Engine Denial of Service Vulnerability
A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
The vulnerability is due to improper validation of zip files. An attacker could exploit this vulnerability by sending an email message with a crafted zip-compressed attachment. A successful exploit could trigger a restart of the content-scanning process, causing a temporary DoS condition.
Cisco has released software updates that address the vulnerability described in this advisory. There are no workarounds that address this vulnerability.
This advisory is available at the fo
Cisco
Cisco Email Security Appliance Zip Decompression Engine Denial of Service Vulnerability
vendor_cisco·CVSS 3.0
CVE-2020-3134 Cisco Email Security Appliance Zip Decompression Engine Denial of Service Vulnerability
CVE-2020-3134: Cisco Email Security Appliance Zip Decompression Engine Denial of Service Vulnerability
A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of zip files. An attacker could exploit this vulnerability by sending an email message with a crafted zip-compressed attachment. A successful exploit could trigger a restart of the content-scanning process, causing a temporary DoS condition. Cisco has released software updates that address the vulnerability described in this advisory. There are no
CVSS: 3.0
CWE: CWE-20, CWE-20
Bug IDs: CSCvq65126
GHSA
GHSA-gf7w-86p9-r93x: [CVE-2020-3134_su] A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an u
ghsa_unreviewed·2022-05-24·CVSS 6.5
CVE-2020-3134 [MEDIUM] CWE-20 GHSA-gf7w-86p9-r93x: [CVE-2020-3134_su] A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an u
[CVE-2020-3134_su] A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of zip files. An attacker could exploit this vulnerability by sending an email message with a crafted zip-compressed attachment. A successful exploit could trigger a restart of the content-scanning process, causing a temporary DoS condition.
No detection rules found.
Nuclei
Grav < 1.7 - Open Redirect
nuclei·CVSS 6.1
CVE-2020-11529 [MEDIUM] Grav < 1.7 - Open Redirect
Grav < 1.7 - Open Redirect
Grav before 1.7 has an open redirect vulnerability via common/Grav.php. This is partially fixed in 1.6.23 and still present in 1.6.x.
Template:
id: CVE-2020-11529
info:
name: Grav < 1.7 - Open Redirect
author: 0x_Akoko
severity: medium
description: Grav before 1.7 has an open redirect vulnerability via common/Grav.php. This is partially fixed in 1.6.23 and still present in 1.6.x.
impact: |
An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks.
remediation: |
Upgrade Grav CMS to version 1.7 or later to fix the open redirect vulnerability.
reference:
- https://github.com/getgrav/grav/issues/3134
- https://nvd.nist.gov/vuln/detail/CVE-2020-11529
- https://github.com/getgrav/grav/commit/2eae104c7a4bf32bc26
No writeups or analysis indexed.
2020-01-26
Published